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Abstract 

In randomized distributed computing, executions encounter branch points resolved 
either randomly or non-deterministically. Random decisions and non-deterministic 
choices interact and affect each other in subtle ways. This thesis is devoted to 
the analysis and illustration of the effects of the interplay between randomness and 
non-determinism in randomized computing. 

Using ideas from game theory, we provide a general model for randomized comput- 
ing which formalizes the mutual effects of randomization and non-determinism. An 
advantage of this model over previous models is that it is particularly effective for 
expressing mathematical proofs of correctness in two difficult domains in random- 
ized computing. The first domain is the analysis of randomized algorithms where 
non-deterministic choices are made based on a limited knowledge of the execution 
history. The second domain concerns the establishment of lower- bounds and proofs 
of optimality. 

The advantage of this model are described in the context of three problems. First, 
we consider the classical randomized algorithm for mutual exclusion [49] of Ra- 
bin. This algorithm illustrates perfectly the difficulties encountered when the non- 
deterministic choices are resolved based on a limited knowledge of execution history. 

We then analyze the Lehmann-Rabin Dining Philosophers algorithm (1981). Our 
analysis provides a general method for deriving probabilistic time bounds for ran- 
domized executions. 

In the last part, we analyze a scheduling problem and give solutions in both the 
deterministic and the randomized cases. Lower bounds arguments show these solu- 
tions to be optimal. For the randomized case, we take full advantage of the game 
theoretic interpretation of our general model. In particular, the proof of optimality 
reflects Von-Neumann's duality for matrix games. 
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Introduction 



For many distributed problems, it is possible to produce randomized algorithms 
that are better than their deterministic counterparts: they may be more efficient, 
have simpler structure, and even achieve correctness properties that deterministic 
algorithms cannot. One problem with using randomization is the increased difficulty 
in analyzing the resulting algorithms. This thesis is concerned with this issue and 
provides formal methods and examples for the analysis of randomized algorithms, 
the proof of their correctness, the evaluation of their performance and in some 
instance the proof of their optimality. 

By definition a randomized algorithm is one whose code can contain random choices, 
which lead to probabilistic branch points in the tree of executions. In order to 
perform these random choices the algorithm is provided at certain points of the 
execution with random inputs having known distributions: these random inputs are 
often called coin tosses and we accordingly say that the algorithm flips a coin to 
make a choice. 

A major difficulty in the analysis of a randomized algorithm is that the code of 
the algorithm and the value of the random inputs do not always completely char- 
acterize the execution: the execution sometimes branches according to some non- 
deterministic choices which are not in the control of the algorithm. Typical examples 
of such choices are the choices of the inputs of the algorithm (in which case the cor- 
responding branch point is at the very beginning of the execution), the scheduling 
of the processes (in a distributed environment), the control of the faults (in a faulty 
environment) and the changes in topology (in a dynamic environment). For the 
sake of modeling we call adversary an entity controlling these choices. In a general 
situation an adversary has also access to random sources to make these choices. (In 



II 



12 Chapter 1. Introduction 

this case the adversary decides non-deterministically the probability distribution of 
the coin.) 

A randomized algorithm therefore typically involves two different types of nonde- 
terminism - that arising from the random choices whose probability distributions is 
specified in the code, and that arising from an adversary, resolving by definition all 
the choices for which no explicit randomized mechanism of decision is provided in 
the code. 

The interaction between these two kinds of nondeterminism complicates significantly 
the analysis of randomized algorithms and is at the core of many mistakes. To un- 
derstand the issues at stake consider a typical execution of a randomized algorithm. 
The execution runs as prescribed by the code of the algorithm until a decision not 
in the control of the code has to be resolved. (For instance, in a distributed context, 
the adversary decides, among other things, the order in which processes take steps.) 
This part of the execution typically involves random choices and therefore, the state 
reached by the system when a decision of the adversary is required is also random. 
Generally, the decision of the adversary depends on the random value of the state, 
Si, reached. Its decision, a l5 in turn, characterizes the probabilistic way the execu- 
tion proceeds in its second part: the branch of the code then followed is specified by 
Si ai. The execution proceeds along that branch, branching randomly as specified 
by the code until a second non-deterministic branch point must be resolved. The 
adversary then makes a decision. This decision generally depends on the random 
value of the state, s 2 , reached, and, in turn, characterizes the probabilistic way the 
execution proceeds in its third part ... The execution thus proceeds, in a way where 
the random inputs used by the algorithm influence the decisions of the adversary; 
decisions which in turn determine the probability distributions of the random inputs 
used by the algorithm subsequently. 

The analysis and the measure of the performance of randomized algorithms is usually 
performed in the worst case setting. An algorithm "performs well" if it does so 
against all adversaries. For example, among the correctness properties one often 
wishes to prove for randomized algorithms are properties that state that a certain 
property of executions has a "high" probability of holding against all adversaries; or 
that a certain random variable depending on the executions, (e.g., a running time), 
has a "small" expected value for all adversaries. 

The proof of such properties often entails significant difficulties the first of which is to 
make formal sense of the property claimed. Such statements often implicitly assume 
the existence of a probability space whose sample space is the set of executions, and 
whose probability distribution is induced by the distribution of the random inputs 
used by the algorithm. But what is "this" probability space? As we saw, the 



13 

random inputs used during an execution depend on the decisions made previously 
in the execution by the adversary. This shows that we do not have one, but instead 
a family of probability spaces, one for each adversary. For each fixed adversary, 
the coins used by the algorithm are well-defined and characterize the probabilistic 
nature of the executions. 

The analysis of a given randomized algorithm it therefore requires one to model 
the set of adversaries to be considered with it: we refer to them as the set of 
admissible adversaries. We must then construct (if possible) the probability space 
(0,4, Ga, Pa) corresponding to each adversary A. It should be noted that the choice 
A of the adversary not only affects the distribution Pa, if it exists, induced by the 
random inputs on the set of executions, but also the set of executions itself. This 
remark justifies that the analysis of a randomized algorithm requires one to consider 
a different sample space 0^ and a different <7-field Ga f° r every adversary A. 



Most authors, including the pioneers in the area of randomized computing, are aware 
that the adversary influences the probability distribution on the set of executions. 
For instance, in an early paper [37] Lehmann and Rabin define a schedule 1 A to be 

"a function which assigns to every past behavior of the n processes the 
process whose turn is next to be active ... Under past behavior we mean 
the complete sequence of atomic actions and random draws with their 
results, up to that time ... This captures the idea that, for any spe- 
cific system, what will happen next depends on the whole history of past 
successes and failures of the processes ... as well as on what happened 
internally within the processes. " 

To each such A, the same paper [37] associates a probability distribution on the set 
of executions. We quote: 

LL For a given schedule A and specific outcomes of the random draws l, 2 
we get a particular computation lo = C0M(A,l) ... On the space of all 
possible outcomes of random draws 1 we impose the uniform distribution. 
The function COM then associates with every schedule A a probability 
distribution on the set of all computation, the probability of a set E of 
computations being defined as the probability of the set of sequences of 
random draws 1 such that C0M(A,l) is in E. " 



In [37] a schedule corresponds to what we call an adversary. 

[37] uses the notation S in place of A, D in place of 1 and C in place of lo. We use A, 1 and lo 
to be consistent with the rest of our discussion. 
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This approach presents well the direction to be followed in a formal analysis. Nev- 
ertheless many of the models and analyses published so far suffer from various 
limitations, incompleteness and sometimes mistakes that we summarize now. We 
use the fact that most of the existing work on randomized distributed computing 
can be classified into one of two classes. 

To begin, there is on the one hand a very rich body of work analyzing the semantics 
and logics of randomized computing (cf. [2, 18, 19, 23, 28, 29, 32, 38, 47, 51, 55, 58]). 
The emphasis in most of these papers is to provide a unified semantics or model of 
computation for the description of randomized algorithms; and to recognize some 
proof rules, methods and tools allowing the automatic verification of some specific 
subclasses of algorithms. The results thus obtained are typically limited in the 
following three ways. A major limitation is that very little in general can be said 
for properties of randomized algorithms that do not hold with probability one: such 
properties are usually too specific to hold in general situations, and also usually too 
hard to be simple consequences of general ergodic theory. For instance, the typical 
problem considered by Vardi in [58] is the "probabilistic universality problem", 
where one checks whether a formula belonging to some temporal logic holds with 
probability one. (This problem can be reformulated in an equivalent way using 
^-automata.) To quote [58], these methods 

"deal only with qualitative correctness. One has often quantitative cor- 
rectness conditions such as bounded waiting time [49] or real-time re- 
sponses [52]. Verifications of these conditions requires totally different 
techniques." 

A second limitation of these methods is that they are directed at randomized al- 
gorithms whose correctness reflects only the asymptotic properties of infinite ex- 
ecutions. A translation of this fact is their relative success in expressing liveness 
properties and their failure in expressing the short-term behavior and correctness of 
the studied algorithms. A third limitation is that, in their generality these methods 
are able to take into account only very marginally the exact numeric distributions 
used for the random inputs. These considerations lead the authors of [38] to say 
that, in their model, 

"only very basic facts about probability theory are required to prove the 
properties needed. Essentially one does not need anything more than: 
"if I throw a coin an infinite number of times then it will fall an infinite 
number of times on heads." 
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A second big body of work in distributed randomized computing is devoted to the 
design and analysis of specific randomized algorithms. 

These algorithms typically introduce randomness into algorithms for synchroniza- 
tion, communication and coordination between concurrent processes (cf. [3, 37, 49, 
36, 48, 50, 14, 21, 25]). If correct (!), these algorithms solve problems that have been 
proven unsolvable by deterministic algorithms [3, 37, 21, 14]. Others improve on 
deterministic algorithms by various measures [49, 36, 50]. The analysis and proof of 
correctness of these algorithms is complex as is attested by the fact that subsequent 
papers were published providing new proofs of the same claims (cf. [29, 47]). 

In spite of successive improvements most of the analyses presented in these papers 
suffer from the fact that the proofs and often even the statements are not expressed 
formally using the probability distributions P4 and that the proofs do not track pre- 
cisely how the adversaries can influence the probabilities. The paper by Aspnes and 
Herlihy [3] is one of the few presenting formally the correctness statement claimed. 
Nevertheless no explicit use of the measures P4 is made during the proof. The 
claims and arguments in the papers [14, 37] and [49] similarly lack a truly formal 
treatment. As a consequence of this lack of formalism, many proofs are effectively 
unreliable to readers not willing solely to rely on claims and neither willing to spend 
the time to reach an intuitive understanding of the algorithm. 



To summarize, the limitations encountered in the papers of the first class stem 
from the desire to develop automatic methods of verification for a wide class of 
randomized algorithms: the wider the class, the less intricate each algorithm can 
be. In contrast, from our point of view, the question of generating the proofs of 
correctness of randomized algorithms can be left to the ingenuity of each prover. 
Instead, our ambition is to derive a probabilistic framework within which most if not 
all mathematical analyses and proofs related to specific randomized algorithms can 
be expressed. This requires two types of construction. First, we need to develop 
a general model defining algorithms and adversaries and formalizing their interac- 
tions. (We call this a general model for randomized computing.) Then, for each 
algorithm/adversary structure (described within the general model for randomized 
computing), we need to characterize the probability spaces used in the analysis. 

To understand better the nature of the work required we describe two situations 
that a general model for randomized computing ought to address. We begin with a 
situation very rarely addressed in the literature but whose consideration places the 
problems encountered in the right perspective. 
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Lower bounds, game theory. Most of the work existing on the analysis of dis- 
tributed randomized algorithms and quoted above either provides an analysis of one 
existing algorithm or provides some tools geared at providing such an analysis. All 
these results can be called upper-bound results: they show that a given problem can 
be solved at a given level of performance by providing an algorithm having that level 
of performance. On the other hand very little work has been done in the direction of 
exact lower-bounds of a randomized distributed problem and in establishing the op- 
timality of a randomized solution to this problem. The lack of formal development 
in this direction is mostly a reflection of the complications involved in randomized 
lower bounds and of the dearth of published work in this area. 3 One exception is 
provided by the combined work of Graham, Yao and Karlin [25, 33] who provide 
precise lower bounds and a proof of optimality for the randomized (3,1)-Byzantine 
Generals Problem: Byzantine broadcast with 3 processes, one of which is faulty. 
Also, in [35], Kushilevitz et al. present some asymptotic lower bounds on the size 
of the shared random variable for randomized algorithms for mutual exclusion. 

A general model for randomized computing ought to provide a solid framework 
allowing also the formal analysis of such lower bounds. In contrast with upper 
bound proofs, the proofs of lower bounds require a model allowing the analyses 
and comparison of a family of algorithms. These algorithms must be evaluated in 
relation with a family of adversaries. 

As mentioned in [3], page 443, [29], page 367, [46], page 145, the situation is actually 
best understood in the language of game theory. The "unified measure of complexity 
in probabilistic computations" proposed in 1977 in [61] by Yao also adopts (implic- 
itly) this point of view and relies fundamentally on Von Neumann's theorem in game 
theory. We will adopt explicitly this point of view in the sequel and let Player(l) 
be the entity selecting the algorithm and Player(2) be the entity selecting the ad- 
versary. In this language, algorithms and adversaries are strategies of respectively 
Player(l) and Player(2). 

If Player(l) selects the algorithm it and if Player(2) selects the adversary A, the 
game played by the two players consists of the alternative actions of the algorithm 
and the adversary: Player(l) takes all the actions as described by it until the first 



The extreme difficulty of proving lower bounds for randomized algorithms is reflected in the 
fact that [33] is one of the most referenced non-published papers! 

Note also that lower bounds for on-line algorithms (cf., for instance, [7, f 5]) are of a very different 
type. These algorithms are not evaluated by their absolute performance but instead by some relative 
measure, usually the ratio of their performance and the performance of the best off-line algorithm. 
In such problems the coupling between the adversary and the algorithm is often easily analyzable, 
using competitive analysis. By contrast, the coupling between adversary and algorithm is much 
harder to analyze in general situations where absolute measures of performance are used. 
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point where some choice has to be resolved by the adversary; Player (2) then takes 
actions to resolve this choice as described by A and Player(l) resumes action once 
the choice has been resolved ... In this game, the two players have conflicting 
objectives: Player(l) selects its strategy so as to heighten the performance studied 
whereas Player (2) selects its own strategy so as to lower it. The performance in 
question depends on the problem studied. 

For instance, in [49] the performance expresses a measure of fairness among par- 
ticipating processes and Player(2) "tries" to be unfair to some process. In [37], 
the performance expresses that "progress occurs fast" and Player(2) tries to slow 
the occurrence of progress. In [3], the performance is measured by the expected 
time to consensus and Player(2) chooses inputs and schedules so as to increase that 
expected time. Also, let us mention that adopting a game point of view provides a 
unifying description of the complex situation studied in [25] by Graham and Yao. 
This paper studies the resiliency of a certain class of algorithms under the failure 
of a single process. There, Player(2) fulfills the manifold following functions. It re- 
ceives some information about the algorithm selected, selects both the initial input 
and the identity of the faulty process, and then monitors the messages sent by the 
faulty process in the course of the execution. 

To finish let us remark that considering the relation between randomized algorithms 
and adversaries as a game between Player(l) and Player(2) is also very useful when 
a fixed algorithm 7r is analyzed. 4 This situation simply corresponds to the case 
where Player(l) has by assumption a single strategy 7r . 

Formalizing the notion of knowledge. It should be intuitively clear that an 
optimal adversary is one that will optimize at each of its steps the knowledge it holds 
so as to take decisions most detrimental to the performance sought by Player(l). 
Similarly, in cases where Player(l) has more then one strategy it to choose from, 
(i.e., in cases where more then one algorithm can be considered), the best strategy 
is one that takes best advantage of the knowledge available about the past moves of 
Player (2) and about the strategy implemented by Player(2). 

Establishing the performance of an algorithm is always tantamount to proving that 
"the optimal" adversary cannot reduce the performance below the level of perfor- 
mance claimed for that algorithm. Equivalently, a proof of correctness must in some 
way establish a bound on the usefulness of the knowledge available to Player(2). 

This justifies that a general probabilistic model for randomized computing should 
formalize the notion of knowledge available to the players. And that it should 



This was actually the original insight of [3, 29, 46]. 
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provide an explicit mechanism of communication between the players, formalizing 
the update of their knowledge as the execution progresses. 

To illustrate this point of view note that in all the formal constructions quoted above 
and associated with the analysis of a specific algorithm (see for instance [3, 28, 29, 
40, 47, 58]) the model proposed for an adversary formalizes that Player (2) makes 
its choices knowing the complete past execution: this was indeed the idea of Rabin 
in [37] quoted above. Nevertheless the correctness of some published algorithms 
depends critically on the fact that Player(2) is allowed only a partial knowledge of 
the state of the system and/or has only a finite memory of the past. The example 
of Rabin's randomized algorithm for mutual exclusion [49] is very interesting in this 
respect. ([49] is one of the few papers venturing into that area.) Due to the lack 
of model, Rabin resorts to intuition to present and establish the main correctness 
property. We quote: 

LL In the context of our study we do not say how the schedule arises, or 
whether there is a mechanism that imposes it ... We could have an 
adversary scheduler who tries to bring about a deadlock or a lockout 
of some process Pi. A special case of this evil scheduler is that some 
processes try to cooperate in locking out another process. Our protocol 
is sufficiently robust to have the desired property of fairness for every 
schedule S . 

We have sufficiently explained the notion of protocol to make it unneces- 
sary to give a formal definition: given a protocol it we now have a natural 
notion of a run a = iiXii 2 X 2 ■ ■ ., resulting from computing according to 
it. Again we do not spell out the rather straightforward definition. Note 
that since process i may flip coins, even for a fixed schedule S there may 
be many different runs a resulting from computing according to it. " 

As mentioned previously, the notion of schedule used in [49] corresponds to our 
notion of adversary. Also, the notion of run used in [49] corresponds to what we 
call the knowledge held by Player(2). As demonstrated in Chapter 3 of this thesis, 
a rigorous proof of the correctness of the algorithm presented in [49] should have 
actually required a formal model stating clearly "how the schedule arises" and also 
formalizing the interaction between Player(l) and Player(2): after having formal- 
ized the setting of [49], we establish that the knowledge at the disposal of Player (2) 
is much stronger then what was originally believed, and that the algorithm is not 
"sufficiently robust to have the desired property of fairness for every schedule S" as 
claimed in [49]. 

The reason for the failure of the proof given in [49] is that it does not take into 
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account the knowledge available to Player (2). Instead it argues solely in terms 
of the distribution of the random inputs; i.e., attempts to prove properties of the 
executions u(A, l) by simply considering the random inputs i. Again, this means 
overlooking the power of Player (2) in influencing the distribution of u(A, l). 



To summarize, we have argued that a general model for randomized computing 
should allow the simultaneous consideration of several algorithms: such situations 
are typically encountered while proving lower bounds. It is natural to view the sit- 
uation as a game between Player(l), the algorithm designer, and Player (2) the ad- 
versary designer. The algorithms are the strategies of Player (X) and the adversaries 
are the strategies of Player (2). This model should provide an explicit mechanism of 
communication between the two players allowing them to update their knowledge 
as the execution progresses. 

The goal of this thesis is to present such a model and to illustrate its generality on 
several examples. We now present the work done in the thesis. 

We present in Chapter 2 a general model corresponding to the previous discussion. 
The model is simply constructed to formalize that both players take steps in turn 
having only a partial knowledge of the state of the system. This knowledge is up- 
dated at every move of either player. We then construct carefully the "natural" 
probability space (i\^, Gk,Ai Pk,a) obtained on the set of executions when the algo- 
rithm is a given it and when the adversary is a given A. Our construction requires 
the technical (but fundamental) hypothesis that all the coins used in the game have 
at most count ably many outcomes. 

To our knowledge, this last probabilistic construction was similarly never conducted 
to completion. In [58] and [29] Vardi and Hart et al. present the <7-field Q Wy ^ that 
allows to study probabilistically events "depending on finitely many conditions". 
Nevertheless some additional work has to be devoted to justify the existence of a 
probability measure P Wy ^ on the set of executions. We prove this existence by a 
limiting argument using Kolmogorov's theorem. 5 



Aspnes and Herlihy in [3] define formally the measure P4 to be the image measure of the 
measure on the random inputs under the mapping: 1 — > lo(A, 1), where 1 denotes a generic sequence 
of random inputs and lo(A, 1) is the unique execution corresponding to a given adversary A and a 
given sequence of random inputs 1. Indeed, the <T-fields are defined precisely so that the mapping 
1 — > lo(A, 1) is measurable. But this approach cannot be used in general situations as it presupposes 
a well defined probability measure on the set of random inputs 1. This is trivially the case when 
the sequence of inputs is obtained with independent coins, in which case the space of random draws 
1 is endowed with the product structure. This property holds for many published randomized 
algorithms such as those in [3, 37]. Nevertheless this is not the case in [4] which considers a 
situation where the weight of the coins used is modulated along the execution. Also, this is not 
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An important feature of our model is the symmetry existing between the notions 
of algorithm and of adversary. Eventhough this symmetry is rather natural in the 
light of the game theory interpretation it nevertheless seems to be rather novel with 
respect to the existing work. Most of the models presented so far are concerned with 
the analysis of a single algorithm, i.e., when Player(l) has a single strategy. This 
very specific (eventhough important) situation obscures the natural game theory 
structure that we reveal and led various authors to asymmetric models where the 
adversaries depend specifically on the algorithm considered. As discussed later, our 
Chapter 7 provides a striking illustration in favor of a symmetric model. 

Our Chapter 3 analyzes Rabin's randomized algorithm for mutual exclusion [49]. 
This algorithm is one of the few in the literature whose correctness hinges critically 
on the limited knowledge available to Player(2). 

As mentioned above, the study of such algorithms is rather complex and requires 
the exact formalization of the notion of knowledge. In the absence of a formal model 
for randomized computing Rabin resorted to intuition in his original paper [49] to 
express and establish the intended correctness statement. One year later, in 1983, 
as an illustration of their general method, Hart, Sharir and Pnueli provided in [29] 
some additional "justifications" to the correctness of the algorithm. 

As part of our analysis we first show how the formal model of Chapter 2 allows 
one to formalize accurately the hypotheses. Our analysis then reveals that the 
correctness of the algorithm is tainted for two radically different reasons. We first 
show that the informal statement proposed by Rabin admits no natural "adequate" 
formalization. The problem is in essence the following. The statement involves 
proving that the probability of a certain event C is "high" against all adversaries 
if a certain precondition B holds. One natural way to formalize such a statement 
might seem to consider the expression 

mf P A [C\B] 

Nevertheless we show that this would be tantamount to giving the knowledge of B 
to Player (2). But Player(2) would not be able to derive the knowledge of B from 
the mere information sent to him in the course of the execution: Player(2) "learns" 



the case in the complex paper [25] where a random adversary adapts its moves based on the past 
execution. Finally, this is not also the case in the general models in [29, 58], where the i-th coin 
used depends on the state s t of the system at the time of the i-th flip. 

Note nevertheless that the argument of Aspnes and Herlihy in [3] is now valid in the light of our 
construction in Chapter 2 which precisely justifies the existence of a probability distribution on the 
sequence of flips even when these flips are not independent. 
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some non-trivial fact from the conditioning on B. Not surprisingly Player (2) can 
then defeat the algorithm if this measure is used. 

This first problem is not related to the proof of the correctness statement but 
"merely" to its formalization. Our analysis shows that such formalization prob- 
lems are general and proposes a partial method to formalize adequately informal 
high-probability correctness statements. 

We then show that the algorithm suffers from a "real" flaw disproving a weaker but 
adequate (in the sense just sketched) correctness measure. The flaw revealed by 
our analysis is precisely based on the fact that the dynamics of the game between 
the two players allow Player (2) to acquire more knowledge then a naive analysis 
suggests. 

To finish we establish formally a correctness result satisfied by Rabin's algorithm. 
The method we apply is rather general and proceeds by successive inequalities until 
derivation of a probabilistic expression depending solely on the random inputs. Such 
an expression is independent of Player (2) and its estimation provides a lower bound. 

Our chapter 4 analyzes Lehmann- Rabin's Dining Philosophers algorithm [37]. In 
spite of its apparent simplicity this algorithm is not trivial to analyze as it requires, 
as usual, to unravel the complex dependencies between the random choices made by 
the algorithm and the non-deterministic choices made by Player (2). The original 
proof given in [37] does not track explicitly how the probabilities depend on the 
adversary A and is therefore incomplete. In a subsequent paper [47], Pnueli and Zuck 
provides a proof of eventual correctness of the algorithm. The method used there 
shares the characteristics of most general semantic methods described on page 14: it 
establishes that some event eventually happens with probability one. Furthermore it 
does not take into account the specific probability distribution used for the random 
inputs. 

We present instead a new method in which one proves auxiliary statements of the 
form U — ► U' , which means that whenever the algorithm begins in a state in set U, 
with probability p, it will reach a state in set U' within time t. A key theorem about 
our method is the composability of these U — ► U' arrows allowing to use each of 

these results as building blocks towards a global proof. (This part was developed 
jointly with Roberto Segala.) Our method presents the two following advantages. 

It first provides a tighter measure of progress then "eventual progress" : we provide 
a finite time t and a probability p such that, for all adversaries, progress happens 
within time t. This trivially implies the eventual progress with probability-one. 



22 Chapter 1. Introduction 

As mentioned in page 14, eventual probability-one liveness properties are usually 
considered not because of their intrinsic relevance but because of the limitations of 
the general methods used. Our method uses more specific and refined tools then 
the very very basic facts about probability theory as "if I throw a coin an infinite 
number of times then it will fall an infinite number of times on heads" mentioned 
by Lehmann and Shelah in [38]. 6 Nevertheless it is still general and simple enough 
to apply to a variety of situations and tighten the liveness measures usually derived. 

An additional advantage of our method is that it does not require working with 
events belonging to the tail <7-field, an enterprise which can present some subtle 
complications. Recall in effect that the argument proposed by Lehmann-Rabin 
consisted in conditioning on the fact that no progress occurred and then deriving a 
contradiction. Our discussion at the beginning of Chapter 3 shows that conditioning 
on any event - let alone conditioning on an event from the tail <7-field - can be 
problematic. 

Our Chapters 5 and 7 are concerned with a scheduling problem in presence of faults. 
Chapter 5 investigates the deterministic case - where algorithms do not use ran- 
domization - and Chapter 7 investigates the randomized case. In both situations 
we are interested in providing optimal algorithms. Both are rather complex even- 
though in very different ways. The solution of Chapter 5 is obtained by translating 
the problem into a graph problem. A key tool is Ore's Deficiency Theorem giving a 
dual expression of the size of a maximum matching in a bipartite graph. 

In Chapter 7 we describe a randomized scheduling algorithm and establish formally 
its optimality. To our knowledge, Graham and Yao were before us the only ones 
providing the proof of the exact optimality of a randomized algorithm. 

The method that we develop to prove optimality is rather general and in particular 
encompasses in its scope the specific proof strategy used by Graham and Yao in 
their paper [25]. This method is presented by itself in Chapter 6. It is in essence 
based on an application of a min-max equality reversing the roles of Player(l) and 
Player(2) in the scheduling game considered. This min-max method uses critically 
the natural symmetric structure between the two players. The success of this point 
of view also brings a striking illustration of the relevance of a general symmetric 
model for randomized computing as claimed at the beginning of this chapter. In 
particular, critical to the proof is the fact that adversaries are randomized and 
defined independently of any specific algorithm, much in the same way as algorithms 
are randomized and defined independently of any specific adversary. 



3 See page 14 of this chapter for a more complete quote. 
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Eventhough the proof of [25] and our proof are both applications of the general 
proof method presented in Chapter 6, the two proofs differ in an essential way. We 
comment on this difference to give an account of the complexities involved in such 
proofs. Critical to the proof of Graham and Yao [25] is the fact that, in their model, 
Player (2) knows explicitly the strategy (i.e., the algorithm) used by Player(l): their 
proof would not hold without this assumption. On the other hand, in the formal 
model that we use, Player (2) is not explicitly provided with the knowledge of the 
strategy used by Player(l), and our proof would not hold if it was. 

Nevertheless, as is argued in Chapter 6, in both [25] and in our work, the optimal- 
ity of an algorithm does not depend on the fact that Player (2) knows or not the 
algorithm under use. Such a fact merely affects the shape taken by the proof. This 
subtle point should make clear, we hope, that formal proofs of optimality are bound 
to be very complex. 

We describe summarily the content of Chapter 6. This chapter presents a general 
proof method to attempt to prove that a given algorithm is optimal. At the core of 
the method is the use of the min-max equality 

maxinf f(ir,A) = min sup f(ir,A) , 

where f(ir,A) is the performance of the algorithm it against the adversary A. Fun- 
damental to us are therefore situations where such an equality occurs: in each of 
these cases our method yields the possibility to prove the optimality of an algorithm. 
We show that this equality occurs in the two following cases. (In the first case the 
equality is a simple reinterpretation of Von Neumann's theorem.) 

1. When the strategies of either player are the convex combinations of a finite 
set called the set of pure strategies (and when f(ir,A) is the expected value 
Ek,a[T] of some random variable T .) 

2. When one player, typically Player(2), "knows" the strategy used by the other 
player. 

The two settings yield different proof systems. Very interestingly our proof of opti- 
mality in Chapter 7 falls in case 1 whereas the proof of optimality [25] of Graham 
Yao falls in case 2. 



To summarize, we present in this thesis a formal and general model for randomized 
computing. Under the assumptions that all the coins have at most countably many 
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outcomes we succeed in constructing formally the probability spaces on the set of 
executions to be used in the analysis of an algorithm. To our knowledge, our model 
is stronger then all models previously constructed in that 1) it accurately allows 
to formalize the precise nature of the knowledge held by both players (this is the 
critical point in Rabin's randomized algorithm for mutual exclusion); 2) it allows 
to conduct formal lower-bound proofs for randomized computing (no formal model 
existed so far allowing that 7 ); and 3) it does not require as in the models presented 
by Vardi in [58] and Hart et al. in [29] that the algorithms be finite-state programs. 
(Actually our model allows for algorithms having a state space with the cardinality 
of the continuum). Our Chapters 3 and 7 illustrate the two first points. The last 
one is a simple consequence of the fact that our model allows the algorithm to have 
an infinite memory. 

In Chapter 3 we present the notion of adequate performance measures for an algo- 
rithm: measures that are "naturally" attached to an algorithm and provide mean- 
ingful estimations. We illustrate this notion in our analysis of Rabin's algorithm 
for mutual exclusion [49]. We furthermore provide a rather general technique for 
proving rigorously high-probability statements holding against all adversaries. 

In Chapter 4 we provide a rather general technique for proving upper bounds on 
time for randomized algorithms. We illustrate this technique in our analysis of 
Lehmann- Rabin's Dining Philosopher's algorithm [37]. 

In Chapter 6 we present a general proof methodology to attempt to prove that a 
given algorithm is optimal. We illustrate this method in Chapter 7 with a specific 
example. 



The model developed by Graham and Yao is an ad-hoc model for the specific situation per- 
taining to [25]. 



Chapter 2 

A General Model for 
Randomized Computing 



We argued in Chapter 1 that formal proofs of correctness of randomized algorithms 
required a formal model for randomized computing. Such a model should formalize 
the notion of algorithm and of adversary, and formalize how these two entities 
interact. 

We also argued that the game-theory point of view was most appropriate to under- 
stand and model these notions. For this, we let Player(l) be the entity selecting 
the algorithm and Player (2) be the entity selecting the adversary. In this language, 
algorithms and adversaries are strategies of respectively Player(l) and Player(2). 
We therefore sometimes call Player(l) the algorithm-designer and Player(2) the 
adversary-designer. If Player(l) selects the algorithm it and if Player(2) selects 
the adversary A, the game played by the two players consists of the alternative ac- 
tions of the algorithm and the adversary: Player(l) takes all the actions as described 
by 7r until the first point where some choice has to be resolved by the adversary; 
Player(2) then takes actions to resolve this choice as described by A and Player(l) 
resumes action once the choice has been resolved ... This means that the two players 
play sequentially. 

The purpose of this chapter is to construct both 1) such a general model for ran- 
domized computing and 2) the associated probability spaces used for the analysis of 
randomized algorithms. Our model is presented in Section 2.3. The construction of 
the associated probability spaces is presented in Section 2.4. Section 2.1 investigates 
the features that a general model should be endowed with. Section 2.2 motivates 
the formal presentation given in Section 2.3. 
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2.1 Which Features should a General Model have? 

We argue here that a model for randomized computing should have the following 
general features. 1) It should not only allow to analyze the performance of a given 
algorithm but the performance of a whole class of algorithms. 2) It should formalize 
the notions of both an adversary and of an algorithm: for emphasis, the algorithms 
and adversaries thus formalized are called admissible. 3) It should allow the adver- 
saries to be randomized. 4) It should allow to formalize that both Player(l) and 
Player (2) have in general only a partial knowledge of the state during the execution. 
In particular it should provide an explicit mechanism of communication between the 
two players allowing them to update their knowledge as the execution progresses. 
And 5), an admissible adversary should be characterized independently of the choice 
of any specific admissible algorithm. 

1. & 2. Concurrent analysis of several algorithms; Formalization of the 
notion of algorithm. As mentioned in Chapter 1 most of the existing models for 
randomized computing (e.g. [3, 28, 29, 47, 54, 58]) are implicitly designed for the 
analysis of one algorithm. In contrast we have in mind a general model in which all 
proofs and arguments about randomized algorithms could be expressed. Our model 
must in particular be suited for the formalization of lower-bound proofs. In that case 
the analysis considers not only one, but a whole family II of algorithms. This family 
must be characterized much in the same way as the family A of adversaries must be 
characterized. Note that characterizing the family II corresponds to modeling the 
notion of algorithm. In all the papers cited above and analyzing a fixed algorithm, 
the necessity to model an algorithm was not felt: more exactly the description of the 
algorithm analyzed was the only modelization required. This situation corresponds 
to the case where II is reduced to a singleton {vr}. 

3. Randomized adversaries. We now turn to the third point and argue that a 
general model should allow the adversary to be randomized. 

It is often claimed that, in the absence of cryptographic hypotheses, the analysis can 
"without loss of generality" consider only non-randomized adversaries. For instance 
in [29] the authors say and we quote: 

"Note that the schedule's "decisions" are deterministic; that is, at each 
tree node a unique process is scheduled. One might also consider more 
general schedules allowing the schedule to "draw" the process to be sched- 
uled at each node using some probability distribution (which may depend 
on the particular tree node). However ... there is no loss of generality 
in considering deterministic schedules only." 
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The reason is that, whenever making a random choice among a set D, an optimal 
Player (2) can instead analyze the outcomes corresponding to all the choices d in 
D, (more exactly to all the measurable choices), and choose one that best lowers 
the performance of the algorithm. (More exactly, can select one that brings the 
performance of the algorithm arbitrarily close to the infimum "inf deD performance 
under choice of d v .) 

The above argument shows that a model allowing the adversaries to be randomized 
does not make Player (2) more powerful. Nevertheless we do not share the more 
restrictive view expressed in [13]: 

LL The motivation for models where the adversary is assumed to exhibit 
certain probabilistic behavior is that the worst case assumptions are fre- 
quently too pessimistic, and phenomena like failures or delays are often 
randomly distributed. " 

Randomization can undoubtedly be useful in a setting where one wants to weaken 
the power of Player (2). But, even when considering an "unweakened"P/a?/er(2) 
allowing Player (2) to use randomization can be of inestimable help in the proof 
of optimality of a given (optimal) randomized algorithm 7r . Indeed, the proof 
methodology - for establishing the optimality of a randomized algorithm - presented 
in Chapter 6 of this thesis requires to provide a specific adversary and to prove 
that this adversary satisfies an optimal property 1 . (Recall that an adversary is a 
strategy of Player {2).') As just mentioned, randomization does not make Player (2) 
more powerful and the existence of such an optimal randomized adversary therefore 
implies the existence of a deterministic optimal adversary. But, in general, the sole 
description of such a deterministic optimal adversary can prove to be a very hard task 
(e.g., taking non constant space - even taking exponential space), therefore barring 
the possibility to establish the optimality of an algorithm - at least using our proof 
methodology. On the other hand, if the adversary is allowed to use randomization, 
we can in some instances provide the description of a "simple" optimal randomized 
adversary, thus also proving the optimality of the algorithm 7r . 

An illustration of this phenomenon is given in the proof of optimality given by 
Graham and Yao in [25]. A close analysis of the proof of [25] shows that it follows 
the general methodology given in our Chapter 6, introduces a specific adversary 
Aq and proves that it verifies an optimal property. A fundamental assumption 
of the model used in [25] is that the Player (2) "knows" explicitly the algorithm 
under use. This knowledge is used critically to define the strategy Ao- at every 
point of the execution, Player (2) determine its next step by emulating it under 



The desired notion of optimality for the adversary will be clarified in Chapter 6. 
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certain conditions. As it is randomized, the emulation of it also requires the uses of 
randomness and Aq is therefore a randomized adversary. 

This discussion justifies that a general model should allow the adversary to use 
randomness. We will provide in Chapter 7 of this work another application of this 
fact. 



4. Formalization of the notion of knowledge. We now turn to the fourth 
point and argue for a model formalizing the notion of knowledge. The model should 
also provide an explicit mechanism of communication between the algorithm and 
the adversary, allowing them to update their knowledge as the execution progresses. 

It should be intuitively clear that an optimal strategy of Player (2) is one where 
Player (2) optimizes at each of its steps the knowledge it holds so as to take decisions 
most detrimental to the performance sought by Player(l). Similarly, in cases where 
Player(l) has more then one strategy it to choose from, (i.e., in cases where more 
then one algorithm can be considered), the best strategy is one that takes best 
advantage of the knowledge available about the past moves of Player (2) and about 
the strategy implemented by Player (2). 

Establishing the performance of an algorithm is always tantamount to proving that 
Player (2) adopting an optimal strategy cannot reduce the performance below the 
level of performance claimed for that algorithm. Equivalently, a proof of correctness 
must in some way establish a bound on the usefulness of the knowledge available to 
Player (2). Similarly, to establish the optimality of an algorithm one is led to show 
that no other admissible algorithm can use more efficiently the knowledge available 
to Player(l). 

This justifies that a general probabilistic model for randomized computing should 
formalize the notion of knowledge available to the players. And that it should 
provide an explicit mechanism of communication between the players, formalizing 
the update of their knowledge as the execution progresses. 



5. An adversary can be associated to any algorithm. We now turn to the 
fifth point and argue that, in a general model for randomized computing, an ad- 
missible adversary should be characterized independently of any specific admissible 
algorithm. Note first that, by definition, an algorithm it is defined independently of 
a given adversary A. On the other hand, an adversary might seem to be defined only 
in terms of a given algorithm: the adversary is by definition the entity that resolves 
all choices not in the control of the algorithm considered. We show over an example 
that this conception is incorrect and that a correct game theory interpretation yields 
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adversaries defined independently of the algorithm considered. 

A situation where one can encounter several algorithms in the course of a correctness 
proof is one where, as in Chapters 3 and 4 of this thesis, a program C is studied 
for various initial conditions Si,i G I. One can then model an algorithm to be a 
couple (C,Sj): we have a different algorithm 7r 4 - for each different initial condition 
Si. 2 The code C is considered to "be correct" (with respect to the specifications of 
the problem considered) if all algorithms behave well against Player (2). Note that, 
in this situation, one implicitly assumes that Player (2) "knows" which algorithm 
7Tj is under use. A strategy A for Player (2) (i.e., an adversary) is then accurately 
defined to be a family (Ai)i e i, one for each algorithm 7Tj. We will say that Ai is 
an adversary specially designed for 7Tj. 3 The adversary A = (Ai)i e i is clearly not 
associated to a specific algorithm 7Tj. 

More generally one will define an adversary to be a strategy of Player(2) taking into 
account all the information available during the execution. (In the previous example 
one assumed that Player(2) was told the algorithm selected by Player(l).) We thus 
obtain a symmetric model where algorithms it in II (resp. adversaries A in A) are 
defined independently of any choice of A (resp. of any choice of it). Because they 
are dealing only with the special case where Player(l) has only one strategy, many 
of the models published have developed in ways obscuring this natural symmetry 
between Player(l) and Player(2), i.e., between adversaries and algorithms. (The 
model presented in [40] suffers of this flaw.) This represents more than an esthetical 
loss. For, as we show in Chapter 6 of this thesis, the symmetry of the two players is 
expressed by a max-min equality and plays a central role in the proof of optimality 
of a randomized algorithm. 



Note that the properties 1, 2, 3 and 5 claimed for a general model - the possibility 
to analyze and compare several algorithms, the necessity to formalize the notion 
of an algorithm, the allocation of randomness to the adversary and the possibility 
to characterize an admissible adversary independently of any specific admissible 
algorithm - are useful mostly for lower-bounds. This explains why none of the 
models considered so far in the literature included these features. 

On the other hand, the fourth claim - that the notion of knowledge is crucial for 
proofs of correctness and should be explicitly incorporated in a model - is very rele- 
vant to upper-bounds. Proofs that do not approach formally the notion of knowledge 
are walking a very slippery path, to use a term first coined in [37] and then often 

We will review this case in Section 2.2. 

We will come back in more detail to this notion in Chapter 6. 
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quoted. An illustration of this fact is, as we will see, the algorithm for mutual ex- 
clusion presented in [49] whose correctness property hinges critically on the limited 
knowledge available to Player(l). 



2.2 Towards the Model 

The previous section outlined the features that a general model for randomized 
computing should be endowed with. This section analyzes in a first part various 
equivalent ways to construct a model and motivates in a second part the formal 
definition presented in Section 2.3. 

2.2.1 Equivalent ways to construct a model 

We illustrate here how equivalent models for randomized computing can be obtained 
by exchanging properties between the model used for an algorithm and the model 
used for an adversary. 

A first difficulty encountered when modeling the notions of adversary and algorithm 
is that these two notions cannot be defined independently. 4 As a consequence, some 
properties can be exchanged between the model used for an algorithm and the model 
used for an adversary. This can lead to develop different but equivalent models. 

We illustrate this fact with three examples. The first example expands on the 
example presented in Section 2.1 and shows that equivalent models can be achieved 
by allocating to Player(l) or to Player(2) the choice of the initial configuration. The 
second example shows that, when considering timed algorithms, equivalent models 
can be achieved by allocating to Player(l) or to Player(2) the control of the time. 
The third example shows that, in the case where Player (2) is assumed to know the 
past of an execution, equivalent models can be achieved by allocating to Player(l) 
or to Player(2) the control of the random inputs to be used next by Player(l). 

Consider first the case of Lehmann- Rabin's algorithm presented in [37] and studied 
in Chapter 4 of this work. 

The correctness property of the algorithm expresses that "progress occurs with 



This is not in contradiction with point 5 above stating that "an admissible adversary should 
be characterized independently of any specific admissible algorithm". We speak here of the way 
we define the sets II and A of algorithms and adversaries. We spoke in point 5 of the way a given 
element A in A is characterized. 
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"high" probability whenever a process is in its Trying section". Let C be the program 
described in [37] and recalled in page 101. A possible way to model the situation is 
to consider that an algorithm it is defined by the conjunction (C,s mit ) of C and of 
the initial configuration s mit . We then derive a family of algorithms, one for each 
initial configuration s mit . In this case, an adversary is a strategy guiding the moves 
of Player(2) against all such possible algorithms (C,s mit ): by assumption Player(2) 
learns which algorithm (C,s mit ) is selected by Player(l) at the beginning of the 
execution. Another possible way to model the situation is to assume the existence 
of a single algorithm, namely C, and to let Player (2) select the initial configuration. 

This modeling duality is similarly encountered in the consensus problem studied 
in [3], in the mutual exclusion problem studied in [49] and more generally in all 
situations where the initial configuration or input is not a priori determined. In [61] 
Yao specifically considers this situation. 

As a second example we now consider the timed version of the same Lehmann- 
Rabin's algorithm [37]. In this situation we restrict our attention only to executions 
having the property that "any participating process does not wait more then time 
1 between successive steps". The control of the time can be allocated in (at least) 
two different ways resulting in two different models. One way is to allocate the 
time control to Player(l): each timing policy such that no participating process 
waits more then time 1 for a step corresponds to a different admissible algorithm. 
Another solution is to assume instead that Player(2) controls the passing of time: 
an adversary is admissible if it does not let time pass without allocating a step to a 
process having waited time 1. This last solution is the one adopted in Chapter 4 of 
this work. 



We provide another less trivial example of the possible trade-off between the notion 
of adversary and the notion of algorithm. This example shows that the two models 
for randomized concurrent systems of Lynch et al. [40] and Vardi [58], page 334, 
are equivalent. We summarize here the model presented in [40]. (See Chapter 4 
and [54] for more details.) In this model a randomized algorithm is modeled as a 
probabilistic automaton: 

Definition 2.2.1 A probabilistic automaton M consists of four components: 

• a set states(M) of states 

• a nonempty set start(M) C states(M) of start states 

• an action signature sig(M) = (ext(M), int(M)) where ext(M) and int(M) are 
disjoint sets of external and internal actions, respectively 
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• a transition relation steps(M) C states(M) X acts(M) X Probs(states(M)), 
where the set Probs(states(M)) is the set of probability spaces (0, Q, P) such 
that C states(M) and £ = 2°. 

An execution fragment a of a probabilistic automaton M is a (finite or infinite) 
sequence of alternating states and actions starting with a state and, if the execution 
fragment is finite, ending in a state, a = s ais 1 a 2 s 2 • • •, where for each i there exists 
a probability space (0,£/,P) such that (s,, a i+ i, (0, £/, P)) £ steps(M) and s J+1 £ S7. 

An adversary for a probabilistic automaton M is then defined to be a function .4 
taking a finite execution fragment of M and giving back either nothing (represented 
as _l_) or one of the enabled steps of M if there are any. 

A quick interpretation of this model is as follows. A step (s, a, (0, Q, P)) in steps(M) 
represents a step of the adversary. During an execution, a step (s, a, (0, £/, P)) 
can be selected by the adversary as its i-th selection only if the state Sj_i of the 
underlying system is s. (Note that this condition implicitly assumes the existence of 
a mechanism allowing Player (2) to "know" precisely what the state of the system 
is. Furthermore the definition of the adversary as a function of the whole past 
execution fragment means that the Player (2) "remembers the past" and chooses 
the successive steps based on this knowledge. This precise model therefore does not 
apply to cases where, as in [49], Player (2) does not have access to the full knowledge 
of the state of the system.) The second field a and the third field (0,£/,P) of the 
step of the adversary characterize the step to be taken next by the algorithm: this 
step corresponds to the action a and consists in choosing randomly an element s t in 
S7 according to the probability distribution P. 



Consider the case where, for every (s, a) in S X A, there is a fixed probability space 
i^l s ,aiGs,aiPs,a) such that, for every step in steps(M), if the state is s and the 
action is a, then the associated probability space is (fi sa , Q Sya , P s , a )- 5 In this case, 
we can change the model of [40] into an equivalent model by making the following 
changes. We model a randomized algorithm to be a family ((i7 sa , t/ sa , P sa )) 
of probability spaces. Following the idea presented in [58], page 334, we redefine 



The model presented in [40] does not always assume this fact: this model is a hybrid where the 
adversary does decide at each step what is the probability space to be used next by the algorithm, 
but where this space might not be uniquely characterized by the action a selected. This means in 
essence that the set of actions, sig(M), is not big enough to describe accurately the set of decisions 
taken by Player(2). In order to do so we need to refine the set of actions. Doing this allows one 
to get a one-to-one correspondence (s, a) £ S x A — > (fi s ,a, Qs,a, Ps,a) and hence reduces the model 
of [40] to our situation. 
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the notion of adversary by saying that an adversary is a function A taking a finite 
execution fragment s , «i, Si • • • of ill and giving back either nothing (represented 
as _l_) or one of the enabled actions of M if there are any. (This action is said to be 
"decided" by the adversary.) 6 Furthermore, if Player (2) decides action a while the 
state is equal to s then the algorithm takes its next step by choosing randomly an 
element s in S7 sa according to the probability distribution P s<a - Hence the family 
((O s a , Q s a , P s a )) of probability spaces can be interpreted as being the local 

dynamics of the algorithm. In this model an algorithm is therefore identified with 
its local dynamics. We will expend on this theme later in Section 2.3. 

It is easy to convince oneself that this model is equivalent to the one of [40]. This 
provides another example of a possible trade-off in the model of the algorithm and 
in the model of the adversary: in essence, the difference lies in whether Player(l) or 
Player {2) characterize the probability space (0,£/,P) - the local dynamics - to be 
used next by the algorithm. In [40] the local dynamics of the algorithm are specified 
in the steps taken by the adversary. In the alternative model that we just outlined 
these local dynamics are given separately and define the algorithm. 

To summarize, the previous discussion illustrates the fact that a model for the anal- 
ysis of randomized algorithms requires the simultaneous modeling of an algorithm 
and of an adversary; and that various equivalent models can be derived by trading 
some properties between the model of an algorithm and the model of an adversary. 
Furthermore, in our discussion about the model of [40], we showed how we could 
define an algorithm by its local dynamics. We also saw that a limitation of this 
model is that it pre-supposes that Player (2) "knows" completely the state of the 
system. This does not fit situations as the one encountered in Rabin's algorithm for 
mutual exclusion that we study in Chapter 3 of this work, where Player (2) has by 
assumption only a partial knowledge of the state of the system. 



The model considered by Vardi in [58] does not have a set of actions but solely a state space: the 
evolution of the system is defined by a concurrent Markov chain. We show here that our redefined 
notion of adversary coincides with the notion of scheduler in [58]. 

In [58], from a given state u, a step of the scheduler determines fully the next state v. This state 
determines in turn the probability distribution to be used for the next step. 

On the other hand, in our modified version of [40], the adversary determines the next action a. 
This, along with the previous state s determines uniquely the probability distribution to be used 
next. 
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2.2.2 Motivations for Section 2.3 

Recall that, if Player(l) selects the algorithm it and if Player (2) selects the ad- 
versary A, the game played (i.e., the unfolding of the execution) consists of the 
alternative actions of the algorithm and the adversary: Player(l) takes all the ac- 
tions as described by it until the first point where some choice has to be resolved by 
the adversary; Player (2) then takes actions to resolve this choice as described by A 
and Player(l) resumes action once the choice has been resolved... This means that 
the two players play sequentially, each move being randomized. Consider a player's 
random move and let R denote the outcome of this random move: R is a random 
variable. Let (0, Q) be the space where R takes values and let P be the probability 
law C{R) of R. 7 

Recall also that our goal is not to construct a computational model that would 
describe the implementation of randomized algorithms, but, instead, to derive a 
probabilistic model allowing their analysis. In this perspective, two different imple- 
mentations of a player's move leading to the same probabilistic output are indis- 
tinguishable: in probabilistic terms, random values having the same probabilistic 
law are indistinguishable. This means that the probability space (0,£/,P) gives all 
the probabilistic information about the move of the player and we can for instance 
assume that this move consists in drawing a random element of S7 with probability 
P. 8 

By definition, a strategy of a player is a description of how the player is to take all 
its moves. Each move being described by a probability space (0,£/,P), a strategy 
can be modeled as a family (0, x ,Q x ,P x ) x€ x of probability spaces. The set X is the 
set of different views of the system that the player can hold upon taking a move. 
This set depends on the assumptions done about the information conveyed to the 
player during the course of an execution, and about the memory of the past moves 
allowed to this player. 

To motivate this notion we discuss quickly the case of Rabin's randomized algo- 
rithm for mutual exclusion presented in Chapter 3, the case of Lehmann-Rabin's 
randomized dining-philosophers algorithm presented in Chapter 4 and the case of 
the randomized scheduling problem presented in Chapter 7. The reader might not 
be familiar with these problems at this point. Nevertheless, even in a first reading, 



See Definition 8.1.2, Page 198, for a definition of the law of a random variable. 

There is a little subtlety here. "Drawing a random element w of Q with probability P" does 
not imply that, for every to £ Q, the singleton {to} is measurable, i.e., is a set in Q. (For instance, 
in the case where is the only element of Q having zero P-measure, if B is an atom of Q (see 
Definition 8.1.1) and if lo is in B, then {to} £ Q only if B = {^}.) Nevertheless this will be the case 
in the sequel as we will assume that Q is countable and that Q is the discrete fr-field V(Q). 
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the following description provides a good intuition of the issues involved with the 
notion of view. 

In Lehmann- Rabin's algorithm [37], Player (2) knows at each time the full state 
of the system and remembers the past execution fragment. Its set X of views 
is therefore the set of execution fragments. (The notion of execution fragment is 
formally presented in Chapter 4.) By contrast, in Rabin's randomized algorithm 
for mutual exclusion [49], Player (2) does not see the full state of the system, but, 
instead, only sees the value of the program-counter pq of each process i: in particular 
Player (2) does not see the values of the various program variables. 9 Here also it 
remembers everything it learns. The set of possible views held by Player(2) upon 
making a move is therefore the set of finite sequences (ii,pc i , . . . ,i k ,pc i ), where 
(«!,..., i k ) is a sequence of process-id's. 

Consider now the case of Player(l) (for the same algorithm [49]). After each of its 
moves, Player(l) only remembers the current state s of the program: s is determined 
by the values of the program counters and of the program variables. Before each of 
its moves it furthermore learns from the adversary which process i is to take a next 
step. Its set of views is therefore the set I x S, where / is the set of process- id's and 
S is the state space of the system. (We can assume that the field i of the view of 
Player(l) is erased, i.e., reset to #, after each move of Player(l).) 

In the scheduling problem of Chapter 7 the two players play the following game. 
At each (discrete) time t, Player(l) selects a set s t of n elements from {1, . . . ,n}. 
Then Player (2) selects an element f t from s t . We assume that Player (2) learns the 
choices of Player(l) (and remembers everything). Its set of views is therefore the set 
of finite sequences Si, /i, s 2 , f 2 , ■ ■ • By contrast, Player(l) learns none of the moves 
of Player (2) and its set of views is the set of sequences s l7 s 2 , . . . 

The intuition behind the notion of view should be clear: a player with a restricted 
knowledge of the state of the system can sometime hold the same view x of two 
different states. Being unable to distinguish between these two states the player 
therefore uses the same probability space (0, x ,Q x ,P x ) to take its next move. 

In the sequel we distinguish between the views of the two players: we let X denote 
the set of views of Player(l) and Y the set of views of Player (2). 

The previous examples illustrate a general principle about the update mechanism 
of the views held by the two players: when taking a move a player changes the 



As shown in the quote presented in page 18, in [49] Rabin actually defines a schedule to be 
a function on the set of finite runs. Equivalently, the assumption of [49] is that Player (2) knows 
the past run of every execution. Nevertheless, a careful analysis of the algorithm shows that this is 
equivalent to having Player(2) knowing the values of the program counters of the processes. 
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state of the system. Both players in general only learn partially the nature of the 
change and update their views as prescribed by the specification of the problem. 
Our model will introduce two functions / and g formalizing how the move of either 
player modifies the state of the system and the views held by both players. Let us 
emphasize that / and g formalize the acquisition of all information by either player. 
This applies in particular to the situation considered by Graham and Yao in [25] 
where Player (2) learns the strategy it selected by Player(l). 

The previous discussion allows us to present in the next section a general model for 
randomized computing. 



2.3 A general Model for Randomized Computing 

2.3.1 The model 

We argued in Chapter 1 and in Section 2.2 that a formal model for randomized 
computing should model simultaneously the notion of algorithm and of adversary 
and should allow for the consideration of several algorithms; that the notion of 
adversary should be modeled independently of the specific algorithm chosen; that 
the adversary should be randomized (i.e., allowed to use randomization). 

We argued also that the situation encountered while modeling algorithms and adver- 
saries was best described in terms of game theory: Player(l) is the entity selecting 
an (admissible) algorithm. Player (2) is the entity selecting an (admissible) adver- 
sary. An algorithm is a strategy of Player(l), whereas an adversary is a strategy of 
Player (2). These two players take steps in turn, following their respective strategies. 

Using this language of game theory, we argued that a precise mechanism should be 
introduced, describing how the state of the system evolves and how the views of the 
two players are affected when one of the two players takes a move. 

This discussion leads to the following definition. 

Definition 2.3.1 An algorithm /adversary structure for randomized computing is a 
tuple 

(S, X, Y, y init , /, g, II, A) 

having the following properties: 

• S is a set called the set of states 
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• X is a set called the set of views of Player (X). By assumption _L is an element 
not in X . 

• Y is a set called the set of views of Player (2) 

• Vimt is th- e initial view of Player (2). By assumption y mit is not in Y . 

• II = {7Tj}j G / is a family of elements called algorithms. Each algorithm 7Tj 
is itself a family of probability spaces, one for each view x in X: 7T; = 

\*'x,ii yx,ii ± x,i )x£X • 

• A = {Aj}j e j is a family of elements called adversaries. Each adversary Aj 
is itself a family of probability spaces, one for each view y in Y U {y im t} : 
Aj = (Qy,j,Gy,j,Py,j)yeYu{y, n „}- By assumption, _L is an element of O yj - for 
all y £ Y and j £ J . 

• f : S X X xY X (\J xe x iei &x,i) —* S X X xY is the update function associated 
to Player(l). 

• g : S X X x(Y I) {y init }) X ({J yeY jej ^y,j) —^SxXxY is the update function 
associated to Player (2). The function g is such that, for every s and s' in S , x 
and x' in X, and a in \Jxex,iei ^,»> we have d( s , x , Vinit, a) = g(s', x', y init , a). 
For every s, x and y, g(s, x, y, _l_) = (_L, _L, _l_). 

Abusing language, we will sometimes find it convenient to refer to a (S, X, Y, y mit , 
f, g, II, A) structure as simply a II/A-structure. This is very similar to the abuse 
of language committed by probabilists when speaking of a probability P without 
mentioning the underlying (T-field. 

We now provide further justifications and reiterate some comments to the previous 
definition. 

We will describe in Section 2.4 how an algorithm/adversary structure for randomized 
computing defines a set of executions. In doing so we will assume without loss of 
generality that Player (2) takes the first move and that its initial view is an element 
yinit not in Y: we can assume this without loss of generality because we can always 
add some dummy moves at the beginning of the game if necessary. The condition 
g(s,x,yi„i t ,a) = g(s',x',yi„i t ,a) for every s and s' in S, x and x' in X, and a in 
Uxex iei ^x,i, ensures that the first move of Player (2) is independent of the values 
the state s and the view x might originally hold. For convenience we will let g{}jmiu a ) 
the value common to all g(s, x, y mst , a). 

Let us emphasize that, eventhough seemingly restrictive, our choice of initial condi- 
tions is very general. In particular our model allows to express that "a randomized 
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algorithm must behave correctly for a family Init of different initial states". (This is 
in particular the case of Lehmann- Rabin's algorithm which we analyze in Chapter 4.) 
Indeed we model such a situation by enforcing that the first move of Player (2) con- 
sists in choosing one of the states s in Init. The subsequent moves then correspond 
to the "normal" exchanges between algorithm and adversary for the initial state 
s selected by Player (2). Hence, in such a model, the fact an algorithm "performs 
well" against all adversaries encompasses that it does so for all initial inputs. This 
example illustrates the power of the game theory setting that we adopt. 

As discussed in Section 2.2, the purpose we seek in a model for randomized comput- 
ing is to analyze randomized algorithms and not to describe them. As a consequence, 
eventhough a move of a player could be implemented in a variety of ways and involve 
several sequential instructions, we are only interested in the probability distribution 
of its output. This explains why we can assimilate a move to a probability space 
(Cl,G,P) and assume that, in order to take this move, the player draws a random 
element of with probability P. 

A randomized algorithm is a strategy of Player(l), i.e., a description of how Player(l) 
is to take all its moves. Each move being described by a probability space (0, Q, P), 
a strategy 7r 4 - can be modeled as a family (£l x ,i,6x,i,Px,i)xex °f probability spaces. 
X is the set of views that Player(l) can have of the system: Player(l) can act 
differently in two moves only if its views are different. This explains why a strategy 
7Tj is associated to a different probability space for each different view x. This 
justifies the definition of an algorithm given in Definition 2.3.1. 

As discussed in Section 2.2, an adversary should similarly be randomized and, in 
general, similarly allowed to have only a partial view of the state of the system. 
This justifies the definition of an adversary Aj as a family of probability spaces 
(Qy,j,Gy,j,Py,j) y eY- The randomization of the adversary will be used crucially 
in Chapter 7. The restricted view of the adversary is a crucial feature of Rabin's 
algorithm for mutual exclusion studied in Chapter 3. 

As mentioned in Page 32, the symbol _L is meant to signify that Player (2) de- 
lays forever taking its next move and that the execution stops. We check that 
our formalism is accurate. Assume that Player (2) selects _L. By assumption 
g(s, x, y, _l_) = (_L, _L, _l_) so that the view of Player(l) is overwritten with _L. As _L 
is not in X , Player(l) does not take any move and the execution stops. 

For emphasis, we sometimes call A the set of admissible adversaries. Similarly II is 
the set of admissible algorithms. In the case where we analyze a single algorithm 7r 
we have II = {vr }. This is the case of Chapter 3 and Chapter 4 of this work. On 
the other hand, in Chapter 7, we will prove the optimality of an algorithm within 
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an infinite class II of algorithms. 

The function / (resp. g) is the update function expressing how the state and the 
views of the two players evolve when Player(l) (resp. Player {2)) takes a move: if 
the state is s, if the views of the two players are x and y, and if a move a in Q, x ^ is 
selected by an algorithm 7Tj, then the new state is s' and the views of the two players 
are changed into x' and y', where s' , x' and y' are defined by f(s, x, y, a) = (V, x', y'). 
Similarly, if the state is s' , if the views of the two players are x' and y' , and if a 
move a' in O yj - is selected by an adversary Aj, then the new state is s and the 
views of the two players are changed into x and y, where s,x and y are defined by 
g(s',x',y',a') = (s,x,y). 

Note that we imposed the function / to be defined on the cartesian product S X X X 
Y X (\J xe x iei &x,i) only for simplicity of the exposition. We could for instance reduce 
its domain of definition to the subset {(s, x, y, a); s £ S, x £ X, y £ Y, a £ U^g/fi^;}. 
The domain of definition of g could similarly be reduced. As we will see in the 
next section, these variations do not affect the probabilistic structure on the set 
of executions derived from the model. Also, we could easily generalize our model 
to the case where, for every (s,x,y), a move a would lead to a randomized new 
configuration (s',x',y'). This situation would correspond to an environment with 
randomized dynamics. For simplicity we consider here only situations where the 
environment has deterministic dynamics. 

The model of Definition 2.3.1 expends on the idea presented in Page 33 and defines 
algorithms and adversaries by providing their local dynamics. Indeed each probabil- 
ity space ($l x ,i,6x,i,Px,i) describes how the algorithm 7r 4 - selects its next move when 
its view is x. And the function / describes what the state and the views evolve into 
after each such move. The adversary is defined through symmetric structures. 



2.3.2 Special cases 

We now mention two special cases which will play an important role in the sequel. 

The analysis of a single algorithm 7r corresponds to the case where II is equal to 
the singleton {vr }: Player(l) has only one strategy. 

A second important case is when the strategies of Player (2) are all determinis- 
tic. This corresponds to the situation where every admissible adversary Aj = 
(Qy,j,Gy,j,P y ,j) is such that all the measures P y j are Dirac measures. In the case 
where the <7-fields Q y j are discrete this means that for all j and y, there exists some 
point ojyj in O yj - such that P y j[ijj y j] = 1. 
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As mentioned in Chapter 1, randomization does not make the adversary more pow- 
erful and we can without loss of generality assume that all admissible adversaries 
are deterministic when a single algorithm is considered. (Or more generally, when 
II is finite.) This fact is largely acknowledged and explains that only determinis- 
tic adversaries are considered in the literature interested in the analysis of a given 
algorithm. (Hart et al. [29], page 359 and Aspnes-Waarts [4], section 5 mention 
explicitly that fact. See also, section 4 of [58] devoted to probabilistic concurrent 
programs, where Vardi models schedulers as deterministic entities.) 

We are now ready to address the question raised in Section 2.2 and characterize 
the global probability space(s) whose sample space is the set executions and whose 
probability distribution is induced by the local dynamics of the two players. 



2.4 The Probability Schema associated to a Il/A-Structure 

Consider an algorithm/adversary structure (in short, a II/A-structure) (S, X, Y, y mit , 
f, g, II, A) as presented in Definition 2.3.1. 

The purpose of this section is to define for each algorithm it in II and each adversary 
A in A a probability space (i\,^i, ^-,^1, -Ptt,^) whose sample space 0,^ is the set of 
executions generated by it and A and whose probability measure P Wy ^ is "induced" 
by the local dynamics of it and A. 

We need first to define the sample space 0,^ and the u-field Q Wy ^. The precise 
sample space 0,^ we have in mind is the set of "maximal" executions, a maximal 
execution being either an infinite execution or a finite execution such that the last 
move of Player (2) is _L. 

The (T-field Q Wy ^ we have in mind is the smallest one allowing to measure (in a 
probabilistic sense) all the sets of executions "defined by finitely many conditions". 

In order to carry out our construction we need to make the following assumption. 

Assumption: The probability spaces ($l x ,i,6x,i,Px,i) an d i^yj^yj^Pyj) defining 
the algorithms in II and the adversaries in A have all countable sample spaces. The 
associated a-fields Q xi and Q y j are the discrete a-fields V(£l x ,i) and V(0, y j). 

(Let us mention that the requirement that all the <7-fields are discrete is not restric- 
tive: if this were not the case we would adopt an equivalent probabilistic model by 
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changing all the sample spaces and taking only one point in every atom. 10 Also, we 
could relax the hypothesis of countability of the sample spaces by requiring instead 
that all the probability measures P xi and P y j have countable support.) 

Let 7Tj = (£l x ,i,6x,i,Px,i)xex an d Aj = (&y,j,6y,j,Py,j)y£Y be t wo elements in II and 
A respectively. A (7T;, «4j)-execution lo is a (finite or infinite) sequence of alternating 
actions a and triples (s,x,y) of states and views ending, if the execution is finite, 
with the state- view triplet (_L, _L, _l_), 

lo = a 1 (s 1 ,x 1 ,y 1 ) a 2 (s 2 ,x 2 ,y 2 ) a 3 (s 3 ,x 3 ,y 3 ) . .. 

S v "• v "• v ' 

Player(2) Player(l) Player(2) 

and having the following properties: 

1. a x G &y, n , u j and (s^x^y^ = g{y iniu a 1 ) n 

2. for every even k,k > 1, a k+1 G Sl yktj and (s k+1 ,x k+1 ,y k+1 ) = g(s k ,x k ,y k ,a k+1 ) 

3. for every odd k, k > 1, a k+1 G Sl Xkti and (s k+1 ,x k+1 ,y k+1 ) = f(s k ,x k ,y k ,a k+1 ). 

A (7Tj,ylj)-execution-fragment is a finite execution-prefix terminating with a state- 
view triplet. For every (7r 8 ',.4j)-execution-fragment u, we define the length |a;| 
of lo to be the number of actions a present in lo. For instance the length of 
a x (s 1 ,x 1 ,y 1 )a2(s2,x 2 ,y2) is 2. We define: 

Q, Wi ^. = {lo ; lo is a (7r 8 ',.4j)-execution}. 

We now turn to the formal definition of Q Wtt A- We endow the sets S, X and Y 
with the discrete u-fields V(S), V(X) and V(Y). We define on i7 7r> ^. the functions 
A k ,S k ,X k ,Y k ; k > 1, by setting A k (u) = a k , S k (u) = s k , X k (u) = x k and Y k (u) = 
y k for every lo = cii (s l7 Xi, yi) a 2 (s 2 , x 2 , y 2 ) • • • of length at least j. We extend the 
definition and set A k (Lo) = S k {Lo) = X k (Lo) = Y k (Lo) = _L if |a;| < k. 

We define Q^ it A to be the smallest u-field making all the functions A k , S k ,X k ,Y k ; k > 1 
measurable: 

Sir,, a, = &(Ak,S k ,X k ,Y k ; k > l) . 

Note that, as for every k the triple S k ,X k ,Y k is defined deterministically in terms 
of A k , S k _i,X k _i and Yj._ 1 , we also have that 

G*i,Aj = a (Ak;k > l) . 



See the Definition 8.1.1, page 198, for a definition of an atom. 

See the discussion on page 37 for a discussion of the special case y = y, n ,t- 
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For the same reason we could have more simply defined an execution uj to be the 
sequence 

uj = aia 2 a 3 ... 

in place of the sequence 

u = a,! (si, a>i, yi)a 2 (s 2 , x 2 , y 2 )a 3 (s 3 , x 3 , y 3 ) ■ ■ ■ 

We will adopt this simplified definition in Chapter 7. Our slightly redundant def- 
inition has the advantage of making explicit states and views which are important 
parameters. 

Recall that, by assumption, all the <7-fields Q xi and Q y j are the discrete u-fields 
V(£l x ,i) and V(£l y j). This implies that for every a in Q, x ^ or yj - the singleton 
{a} is in Q xi or Q y j, respectively. Hence, for every sequence (a l7 . . . , a fc ), the set 
{Ai = cii,...,A k = a k } is measurable in Q Wtt A- This allows us to present the 
following equivalent definition o{Q Wt ^.. For every (7Tj,.4j)-execution-fragment a we 
define the rectangle R a to be the set of (7r 8 ',.4j)-executions having a as their initial 
prefix. Then 

Q Wt ^. = cr(R a ; a is a (7r 8 ',.4j)-execution-fragment) . 

This formalizes the claim formulated at the beginning of this section that Q Wtt A- 1S 
the (T-field allowing to measure probabilistically all the sets of executions defined 
"by finitely many conditions". 

We now turn to the definition of the global probability measure P Wtt A ■ We want 
this measure, if it exists, to be compatible with the local dynamics defining 7r 4 - 
and Aj. This means that, if a = cii (s l7 Xi, yi) a 2 (s 2 , x 2 , y 2 ) . . . a k (s k , x k , y k ) is a 
(xj, Aj)-execution-fragment, then 

P *i,Aj[Ra\ = Py, n ,t,A a l\ Px 1 ,i[ a 2\ P y 2 ,j [ a 3\ ■ ■ ■Px k - 1 ,i[ a k\ i 

where, for the sake of exposition, we assumed that k was even. We now define a 
filtration (Gk)k>i °f {^■k 1 ,a^Q-k 1 ,a)^ i- e -? an increasing sequence of sub-u-fields of 
Ow,,a- For every k,k > 1, we set 

Q k = a(R a ; a is a (7r 8 ',.4j)-execution-fragment, \a\ < k) . 

The (T-field Q k should be more appropriately called Qij ik - We drop the indices i and 
j for simplicity. Then, for every k > 1, setting 

Pfc[-Ra] = Py,„,t,j[ a l] Px 1 ,i[ a 2\ Py 2 ,j [ a 3\ ■ ■ • Px k > _ 1 ,i[ a k'\ 
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for every (7Tj,.4j)-execution-fragment a of even length k' < k, and similarly setting 

Pk[R a ] = Py, n , 1 ,j[ a l]Px 1 ,i[a2] Py 2 ,j[ a 3] ■ ■ ■ Py k , _ 1 ,j[ a k'] 

for every (7Tj,.4j)-execution-fragment a of odd length k' < k, defines a probability 
measure ~P k on Q k . The probability measures (Pfc)fc>i are compatible in the sense 
that, if k < I are two integers then Pj.[_R a ] = P;[i?„] for every (7Tj,.4j)-execution- 
fragment a of length at most k. Equivalently, the measures ~P k and P; coincide on 
Qk- Therefore, by Kolmogorov's extension theorem, (see for instance [56], page 161— 
163), there exists a (unique) probability measure P defined on the <7-field a(yj k Q k ). 
As o(yj k Q k ) = Q Wtt A- we have therefore established the existence of a probability 
measure P defined on (i7 7r> a-, Q Wt a) and compatible with the local dynamics defin- 
ing 7Tj and Aj. This measure P is the measure P Wtt A- we were after. 

This finishes to characterize the global probability space (i7 7r> a ., Q Wtt A-, Pw,,a) com- 
patible with the local dynamics attached to an algorithm 7r 4 - in II and an adversary 
Aj in A as defined in a IL/A structure (S, X, Y, y mit , f, g, II, A). The construction 
required that the probability spaces (O^-, Q x ,i, Px,i) an d (i\j, Q y j, Py,j) defining the 
algorithm 7r 4 - and the adversary Aj have all countable sample spaces. 

The analysis of a 11/ A structure requires the simultaneous consideration of all the 
probability spaces (i7 7r> a-, Q Wt a-, P Wt a)- Correspondingly, the notion of event has 
to be modified to take into account the various choices of strategy made by Player(l) 
and Player (2). The next definition summarizes these facts. 

Definition 2.4.1 The family (fi f ,4, ^ Ti y(, ^r,4)(ir,^)enxA ?s called the probability 
schema attached to the algorithm /adversary structure (S, X, Y, y mit , f, g, II, A). 
An event schema B is a family B = (-B 7 r 1 ^)(7r,^)6nxA; where B w a £ Ow,a f or every 
(ft, A) GlIxA. A variable-schema X is a family X = (X 7ri A)(Tr,A)eiixA> where, for 
every (ft, A) G II X A, X Wi a ?s a random variable measurable with respect to Q Wt A- 



Traditionally Kolmogorov's theorem is stated for ]R°° endowed with its Borel u-field 
^(M 00 ). We therefore explain and justify here our use of Kolmogorov's theorem in 
the previous construction. This discussion is technical and not fundamental for the 
rest of the work. 

Recall that, by assumption, all the sample spaces Q, x ^ and O yj - are countable and 
endowed with their discrete u-fields V(£l Xt i) and V(0, y j). By relabelling we can 
therefore take all these spaces to be equal to N endowed with the discrete u-field 
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Hence we can take £l Wit A- = N X N X ... endowed with the product o- 
field V(N) ® V(N) ® . . . For each k, the u-field Q k then corresponds to the set 
{4xNxNx...;i£ P(N & )}. For each k the space N k is a complete (a Cauchy- 
sequence in N k is constant after a certain rank and hence obviously converging) 
separable metric space (for the topology induced from M. k ). As every point in N k 
is open, the u-field V(N k ) is trivially generated by the open sets. Therefore the 
extension of Kolmogorov's theorem given in [56], page 163, applies. 



Chapter 3 

Rabin's Algorithm for Mutual 
Exclusion 



3.1 Introduction 

In this chapter we study the correctness of Rabin's randomized distributed algo- 
rithm [49] implementing mutual exclusion for n processes using a read-modify- write 
primitive on a shared variable with O(log n) values. As we are concerned with a sin- 
gle algorithm, the remarks made in Section 2.3.2 of Chapter 2 allow us to consider 
only deterministic adversaries throughout the analysis. Rabin's algorithm differs 
markedly with most other work in randomized computing in the three following 
ways. 

1. The correctness statement is expressed in terms of a property holding with 
"high" probability for all adversaries. Formally, such a statement is of the 
form 

mf Ai P A [W A \I A ]>a, 

where W and / are event schemas 1 and A' is a subset of the set of admissible 
adversaries A. Nevertheless, in contrast with much previous works, "high" 
does not mean here "with probability one", i.e., a is not equal to one. 

2. This correctness property is relative to the short term behavior of the algo- 
rithm and depends critically on the specific probability distribution of the 
random inputs. 



See Definition 2.4.1, page 43. 
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3. The adversary is assumed to have only a partial knowledge of the past execu- 
tion. 



We comment here on properties 1-3. Properties 1 and 2 are related. Property 3 is 
of another nature. 

As discussed in Chapter 1, most correctness statements for randomized algorithms 
are either expressed in terms of a high expected performance or in terms of a property 
holding with probability one. For instance the algorithms presented in [3] and [4] 
are shown to have a low worst case expected running time. 2 On the other hand, the 
original property claimed in [37] for Lehmann-Rabin's algorithm is that "progress 
occurs with probability one". 

A reason for considering probability-one statements is that they arise naturally from 
considerations of ergodic theory and zero-one laws. In particular, a feature of these 
statements is that the events whose probability is claimed to be one belong to the 
tail (T-field of the executions, i.e., depend (only) on the asymptotic properties of the 
executions. Also, these properties usually do not depend on the precise numeric 
probability values associated to each random input X n . Instead, they typically 
depend only on the asymptotic properties of the sequence (X n ) 3 



Jn ' 



Such a setting has been exploited by authors interested in the logic and semantic 
of randomized computing. (See for instance [19, 28, 29, 47, 58].) The methods 
presented in these papers are directed at randomized algorithms whose correctness 
reflects the asymptotic properties of infinite executions, depends only marginally on 
the numeric specifications of the random inputs and, is expressed as a probability- 
one statement. 

These methods therefore do not apply to algorithms as Rabin's algorithm whose 
correctness, as we will see, is relative to the short term behavior of the algorithm, 
depends critically on the specific probability distribution(s) of the random inputs 
and is expressed by a non trivial high-probability statement. 



The term "worst case" refers to the adversary. The precise measure used in [4] is the worst 
case expected running time per processor. 

The Borel-Cantelli Lemma provides a good example of a classical result of probability theory 
which depends only on the tail of the sequence of events considered. This property states that, if 
(j4n)n6N is a sequence of independent events, then infinitely many events A„ occur with probability 
one if and only if the sum ^ P(A n ) is infinite. Assume for instance that A„ = {X n = H} where 
(^njiieH is a sequence of flips made with independent coins. (The coins are possibly all different.) 
Then Head appears infinitely often if and only if ^ P[X„ = H] = oo. This depends only on 
the asymptotic property of the coins and depends on the bias of the coins only through the sum 

E n P[Xn=H]. 
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These difficulties significantly complicate the analysis of any randomized algorithm. 
But one of the most significant challenges encountered in the proof of correctness of 
Rabin's algorithm [49] is to account formally for the limited knowledge granted to 
the adversary. As mentioned in Chapter 1, to our knowledge, our model of Chapter 2 
is the first to present a general and formal framework allowing for adversaries with 
limited knowledge. In the absence of such a framework, the analyses of non trivial 
algorithms as the one presented in [49] have been fraught with mistakes in two rather 
incomparable domains. 

Mistakes can happen of course in the proof of the property claimed. Such mistakes 
are not uncommon, as it is very hard to formally disentangle in a proof the combined 
effects of randomness and of non-determinism. In particular, recall from Chapter 2 
that the formal analysis of a randomized algorithm requires to work within a class 
of different probability spaces {^IaiGaiPa)-, one for each admissible adversary A. 
A proof is therefore not truly formal unless it explicitly records the presence of the 
adversary A in the probabilistic expressions involved. 

But the complications in the analysis of a randomized algorithm sometimes begin 
with the formalization of the intended correctness property, i.e., even before the 
proof itself begins. Indeed, as we will see in Section 3.2, even a simple statement 
including a precondition can lead to very delicate problems of formalization. Using 
an image one might describe this problem as a Solomon dilemma trying to ascertain 
"which of the two players should bear the responsibility of the precondition" . 

The example of Rabin's randomized algorithm for mutual exclusion illustrates per- 
fectly the two types of difficulties and the dangers encountered with arguments not 
fully formalized. In [49], Rabin claimed that the algorithm satisfies the following 
correctness property: for every adversary, any process competing for entrance to the 
critical section succeeds with probability 0(l/ra), where m is the number of compet- 
ing processes. In [29], Sharir et al. gave another discussion of the algorithm as an 
illustration of their formal Markov chains model and argued about its correctness. 

However, both papers did not write formally the correctness property claimed and 
did not make explicit in their arguments the influence of the adversary on the 
probability distribution on executions. 

We show in this chapter that the correctness of the algorithm is tainted for the 
two different reasons described above. We first show that the informal correctness 
statement claimed by Rabin admits no natural "adequate" formalization. 4 We then 
show that the influence of the adversary is much stronger than previously thought, 
and in fact, the high probability correctness result claimed in [49] does not hold. 



The notion of "adequate" formalization is discussed in Section 3.2. 
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3.2 Formalizing a High-Probability Correctness State- 
ment 

As mentioned above, the complications in the analysis of a randomized algorithm 
sometimes begin with the formalization of the intended correctness property, i.e., even 
before the proof itself begins. Consider for instance a correctness property described 
informally in the following general format: "for all adversaries, if property B holds 
then property C holds with probability at least 1/2". (The probability 1/2 is chosen 
only for the sake of illustration.) How can we formalize such a statement? In the 
sequel we will refer to C as the target property and to B as the precondition. 

Again, as discussed in Chapter 2, we know that the property B is actually formal- 
ized to be a family of events (B A ) AeA (each B A is an element of the u-field Qa)-, 
and that, similarly, C is a family of events {Ca)aza- Also, the probability referred 
in the informal correctness statement depends on A and corresponds to different 
probability distributions P A . In spite of this comment we will conform to the tra- 
dition, and write for simplicity B and C instead of B A and C'a and emphasize only 
when necessary the dependence in A. (The dependence in A will nevertheless be 
everywhere implicit.) On the other hand, we will find it useful to emphasize the 
dependence of the probability P A on the adversary A. This being clarified, how do 
we formalize the "if B then C" clause of the statement? 

Following well-anchored reflexes in probability theory we are naturally led to trans- 
late this statement into a conditional probability and say that, for every A, we 
compute the probability of the event C'a conditioned on B A . Indeed, condition- 
ing on an event B exactly formalizes that we restrict the probabilistic analysis to 
within the set B. (The elementary definition of conditioning in terms of Bayes' rule 
expresses that we restrict our attention to within B and consider the trace C P\ B 
of C in B. The denominator P[B] is there to normalize the restricted measure 
C — ► P[C fl B] into a probability measure. 5 ) We can then formalize the previous 
informal correctness statement into 



mf AeA;PA[B]>0 P A [C\B}>l/2 



A more general definition of conditioning is as follows. In that case the "notion of restricting 
the analysis" is formalized as an orthogonal projection in an adequate setting. 

Let Q , Q ; Q C Q be two <r-fields, and let (Q, Q , P) be a measured space. For every function / 
in L (dP), we define the conditional expectation E[f | £/'] to be the orthogonal projection (in the 
L -sense) of the (/-measurable function / onto the subset of L (dP) composed of (/'-measurable 
functions. We recover the elementary definition in the case where / is the indicator function of a 
set C and Q = {0, B, B, Q}: in that case, the orthogonal projection of / onto Q is coincides with 
the intersection C C\ B. 



3.2. Formalizing a Correctness Statement 49 

The restriction -FU[-B] > expresses that we consider only adversaries A for which 
the precondition B is of probabilistic relevance. 



An example. 

We now show that, in some (frequent) cases, the dependence on A of the correct- 
ness statement can have far reaching consequences and negate intuitive properties. 
Consider for instance the following example proposed in a footnote of [11]. 

Imagine performing a random walk on a line, but where the adversary 
can stop you at any time t < 100. One might like to say that: "if the 
adversary allows you to make 100 steps, then with probability at least a 
half you will have made 40 steps to the right". 

We now formalize this statement. For all adversaries, the sample space can be taken 
to be S7 = {H, T} 100 . For all adversaries, we also consider the associated discrete 
(T-field 2°. The probability distributions P4 are defined as follows. Let a be an 
execution-fragment (i.e., a sequence of draws). If A does not allow the occurrence 
of a (i.e., if there is a strict prefix a x of a after which A allocates no steps) then 
P4[a] = 0. If A allows the occurrence of a but blocks the execution at a then 
P4[a] = 2~' a ' +1 , where \a\ denotes the length of a. If A allows the occurrence of 
a and does not block the execution at a then P^fa] = 2 - '"'. Hence the support 
of the measure P4 is exactly the set of maximal executions allowed (with non-zero 
probability) by A. We argue that this construction corresponds to an equivalent 
form of the general construction given in Chapter 2. In Chapter 2 we (construct and) 
consider a different probability space (0^, Ga^ P4) for every adversary A: Cl^ is the 
set of maximal executions under A. Here we consider instead a measurable space 
(0, Q) common for all the adversaries. Note that the two measurable structures are 
related: {SIa-iGa) ^ iS^iG) f° r ever Y -4- (This means that 0^ C J7 and that Ga^G 
for every A.) The equivalence between the two models is ensured by the fact that, 
in both cases, for every A the support of P4 is equal to 0^. 

We define B to be the event "the adversary allows you to make 100 steps" and 
let C to be "Head comes up at least 40 times in the experiment". Is it true that 
Pa\C I B] > 1/2 for all adversaries A allowing 100 steps with non-zero probability ? 
The answer is no. For instance, let A be the adversary that stops the process as 
soon as a Head comes up. This adversary allows 100 steps with some non-zero 
probability, namely when all draws are Tail. On the other-hand, for this adversary, 
conditioned on B, the number of Heads is at most 1 with probability 1. 

But this argument only shows that the correctness property proposed does not fit 
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the algorithm, not that the algorithm is "not correct" 6 : the algorithm must be 
evaluated by other means. For instance, as we now show, the algorithm satisfies 



mf AeA]PAB]=1 P A [C]>l/2 



and also satisfies 



mf AeA P A [B^C]>l/2 



In this last statement B =>■ C denotes the event B U C. (B denotes the complement 
of B.) The first statement is easily proven, as, by definition, "-FUf-B] = 1" means 
that the adversary allocates 100 steps and that, correspondingly, 100 independent 
coin tosses are performed: 

inf -fU[C] = Prob[100 independent flips result in at least 40 Heads] 

> 1/2. 

The second statement is harder to prove and is actually a consequence of the equality 
inf AgA P A [B =>■ C] = mf A e A] p A [B]=i Pa[C] , which we now establish. Let us empha- 
size that, as we will later argue, this equality does not hold in general. The idea 
of the proof is that an adversary providing less then 100 steps in some executions 
yields a higher or equal probability P A [B =>■ C] then some other adversary always 
allocating (at least) 100 steps. 

To argue this formally, consider an adversary A for which P A [B =>■ C] is minimized. 
Assume the existence of an execution-fragment a (i.e., a sequence of draws) having 
length k for some k less then 100, and such that 1) P^fa] > and 2), A does not 
allocate any steps after a. (We will call Stop A the set of such execution fragments 
a.) Consider the adversary A' which is equal to A except that A' always allocates a 
total of 100 steps if the execution begins with a. Let D denote the event "the first 
k draws do not yield a". Note that, by definition of D and A, P A [D C B] = 1, and 
hence: 

P A [B ^C} = P A [B ^C,D} + P A [B ^C,D} = P A [D] + P A [B =>C,D]. 

We have: 

P A \B ^C] = P A ,[B^C\ D] P A ,[D] + P A \B ^C\D] P A ,[D] 



The algorithm considered here is the trivial algorithm associated to the random walk and whose 
code is "flip a coin": whenever the adversary allocates a step that unique instruction is performed. 
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= P A ,[B => C | D] P A ,[D] + P A [B^C\D] P A [D] 


(3.1 


= P A ,[B^C\ D] P A [D] + P A [B^ C, D] 


(3.2 


< Pa[D] + P a [B^C\D] 




= P A [B^C]. 





Equations 3.1 and 3.2 come from the fact that A' behaves as A in D and during the 
execution fragment a: A' behaves differently only if and once a appears, i.e., in D. 

We have therefore constructed an adversary A' such that l^top^,! < l^top^l, i.e., which 
brings to termination "more" executions then A and which is such that P A \B =>■ 
C] < P A [B =>■ C]. By iteration, we can therefore produce an adversary that we 
will still denote A' which allocates always 100 steps, i.e., such that -FU'f-B] = 1, 
and whose associated probability P A \B =^ C] is no bigger then P A [B =^ C]. This 
justifies the following first equality. 

inf P A \B=>C] = inf P A \B => C] 

A ^ L J A,P A [B]=1 ^ L J 

inf P A [C] 

A,P A [B] = 1 

> 1/2. 

Remark that the proof of the equality inf^ P A [B =4> C] = inf^p^[ B ] =1 -FUfC] was only 
possible because of the special nature of the problem considered here. In particular 
we found it very useful that all the spaces (Qa>Ga) were finite and equal for all 
adversaries and that the events B and C were true events (and not only general 
event-schemas). Also, the proof uses that, for every adversary A, it is possible to 
construct an adversary A' having the following two properties: 

1. The adversary A' gives probability one to B: Pa'[B] = 1- 

2. The adversary A' "makes the same decisions as the adversary A along the 
executions ending in B under the control of A v . More formally, the probability 
measure P A i coincides with the probability measure P A on the set {uj; uj £ 
B and P A [w] > 0}. 7 

The following modification on our example illustrates the importance of the first 
previous property. (An example illustrating the importance of the second property 
could similarly be constructed.) Assume that the game is changed so that, now, 
an execution can also stop with some probability e at each step of the random 



This property was the key for the derivation of Equations 3.1 and 3.2. 
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walk. Then, obviously, no adversary can ensure termination with probability one 
i.e., for all A, Pa[B] < 1- Hence infAeA,p A [B]=i Pa[C] = oo. 8 On the other hand 
inf AeA Pa[B =^ C] is obviously bounded (by l!) and hence inf^g^ Pa[B =^ C] < 
inf AeA, p a [b]=i -FUfC]. This inequality is general as the following proposition demon- 
strates. (We emphasize there for formality the dependence on A.) 



Proposition 3.2.1 Let B = (Ba)a€A an d C = (Ca)a€A be two event schemas. 
Assume that {A G A] P A [B] > 0} ^ 0. Then 

inf P A [C A I B A ] < inf P A [B A => C A ] < inf P A [C A } - 8 

AeA,P A [B A ]>0 AeA AeA,P A [B A ] = l 

Proof. We abuse notations slightly by writing B instead of Ba and C instead of 
C'a. Obviously, A x = {A G A; Pa[P] = 1} is a subset of A. Also, for every A in Ai, 
we have Pa[B =>■ C] = Pa[C]. This establishes that 

inf P A \B=>C}< inf P A \C] . 

AeA ^ J - AeA,P A [B] = l ^ L J 

Let A 2 be the set {A G A] P A [B] > 0}. If A G A- A 2 then, by definition, P A [B] = 
and hence Pa[B =>■ C] = 1. As by assumption A 2 is not empty, this trivially implies 
that inf^ 2 P A [C | B] < inf A eA-A 2 Pa[B => C]. s 

Consider now an adversary A in A 2 . We have: 
Pa[B^C] = P A [BUC] 

= PA[Bu(CnB)] 

= Pa[B] + Pa[CTiB] 

= Pa[B] + Pa[C\B]P a [B] 

= (1 - P A [C I B})P A [B] + P A [C | B] (P A [B} + P A [B]) 

> Pa[C\B] 

This immediately implies that inf^ G ^ 2 Pa[C \ B] < inf aea 2 Pa[B =>■ C]. This 
inequality along with the one proved above establishes that 

inf P A \C I 51 < inf P A \B => CI . 

AeA 2 ■ Al ' J - .AeA ^ L J 

D 



Recall that inf x gx f(x) = oo if X is the empty set. This is justified by the fact that, by 
definition, inf x gx f(x) is the biggest lower bound of the set {f(x);x £ X}. Hence, if X is empty, 
all numbers are lower bounds and the infimum is therefore infinite. 
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Note also the interesting general probabilistic relation, which is easily derived using 
Bayes' rule: P[B => C] = P[C | B] if and only if P[B |~| C] = P[B] P[C], where we 
let C" denote the event B => C. In particular, P[B => C] = P[C \ B] if (B => C) is 
independent of B. 9 

Which correctness measure is adequate. 

The previous discussion shows that "adequately" formalizing the correctness state- 
ment of a randomized algorithm is a not trivial problem. We proposed three possible 
ways to formalize a correctness statement presented in the format: "for all adver- 
saries, if property B holds then property C holds with probability at least e." It 
is natural to wonder which of the three is most "adequate" in practice, whether 
they have different domains of application and whether some other good or even 
better measures exist. The answer to these questions has significant implications 
as it determines the benchmark to which randomized algorithms are evaluated and 
against which their correctness is decided. 

What do we mean by an "adequate measure"? The example discussed in page 49 
provides a good illustration of the problem. We showed that, for this game and 
the choices B = "100 steps are allocated", C = "At least 40 Heads turn up" the 
measure '^AeA,p A [B]>o Pa[C I B] is equal to 0. The intuition behind this result 
is that the use of this measure provides Player (2) with the implicit knowledge of 
B. (See page 207 for a discussion on implicit knowledge.) Using this knowledge, 
Player (2) is then able to select a specific strategy A so as to annulate the probability 
of occurrence of C . 

To justify why this measure is not adequate we have to return to our original inten- 
tion. We can assume that we are provided with a 11/ A structure (S, X, Y, y mit , f, g, 
II, A) as in Definition 2.3.1, page 36, formalizing how the game is played between 
Player(l) and Player (2). (As we are analyzing a single algorithm 7r , II is by defi- 
nition equal to the singleton {vr }. Also, as mentioned at the beginning of the chap- 
ter, the set A of admissible adversaries contains only deterministic adversaries.) 
We would ideally like to play the role of a passive observer, able to analyze the 
game without interfering with it. In this perspective, a measure is deemed adequate 
if its use does not perturb the experiment, i.e., the game between Player(l) and 
Player(2). 

It is clear from our discussion that the measure '^AeA,p A [B]>o Pa[C I B] greatly 
affects the game: we arrive at the scene, impose the unnatural condition B and let 



The relation P[B C\ C'] = P[B] P[C] does not imply the independence of B and C', because 
this independence also involves similar relations with the complements of B and C . 
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Player (2) use it to its fullest. By contrast, an adequate measure would be one that 
would derive probabilistic facts about the 11/ A structure that would hold similarly 
if no measure was conducted. (This will constitute our definition of adequacy. As in 
physics, it is hard to formalize how a measure influences the ambient structure. The 
reason for the difficulty is by essence that we have access to the structure studied 
only by measuring it.) With this in mind we can now come back to the analysis of 
our three measures. 



Probabilistic conditioning. First note that the adversary is restricted in a mini- 
mal way by the precondition B when the measure 'mfAeA,p A [B]>o Pa[C I B] 1S used: 
it must just not disallow B probabilistically. Furthermore, as is discussed in Chap- 
ter 8, page 207, Player (2) learns implicitly that the execution is restricted to within 
the set B. Player (2) can take selective actions (i.e., design some specific strategy 
A) so as to take advantage of this knowledge. 

Conditioning by adversary. By contrast, if the measure 'm.fA€A;P A [B]=i Pa[C] is 
used, Player (2) is in some sense "fully responsible" to ensure that the precondition 
B happens. The only strategies of Player(2) (i.e., the only adversaries) that are 
retained are those that ensure with probability one that B happens. 

These two measures correspond therefore to two extremes cases. In the setting 
imposed by the first measure, Player (2) can use without any restriction the infor- 
mation that the executions take place in B. In the second setting Player (2) is most 
restricted and must select strategies ensuring that the executions happen in B with 
probability one. 

The third measure inf^g^ Pa[B =>■ C] does not define so precisely the role played 
by Player (2) in bringing the event B or in taking advantage of it. The fact that 
an execution falls in (B =>■ C) is controlled in a mixed fashion by both the ran- 
dom choices used by the algorithm and by the choices made by Player (2). As 
discussed in the example presented in page 51, this measure corresponds to the 
measure inf^g^.p^[ B ] =1 Pa[C] only under very specific circumstances. On the other 
hand neither of the two values inf^g^ Pa[B =>■ C] and '^AeA,p A [B]>o Pa[C I B] is 
uniformly bigger than the other. 



These considerations show that the first measure '^AeA,p A [B]>o Pa[C I B] using 
probabilistic conditioning is an adequate measure in situations where the " nat- 
ural dynamics of the game" (i.e., the dynamics described by the 11/ A structure 
(S, X, Y, yi„u, f, g, II, A)) are such that the precondition B is part of the knowl- 
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edge of Player (2). 10 Indeed, as we just argued, this measure implicitly gives the 
knowledge of B to Player(2). The measure is adequate, i.e., passive, exactly when 
the dynamics ensure naturally that Player(2) holds that knowledge. A typical ex- 
ample of this situation is obtained when B represents a knowledge that Player(2) 
can have acquired during an execution. 

Similarly, the second measure \^i A ^A,p A [B]=i -FUfC] using conditioning by adversary 
is adequate in situations where the dynamics of the 11/ A structure are such that 
the precondition B depends solely of Player^). 11 This was the situation in the 
example presented previously in this section: Player(2) was "naturally" the only 
entity deciding the schedule. This situation - where B represents a scheduling deci- 
sion depending solely of Player(2) - provides a typical example where the measure 
inf AeA] p A [B]=i Pa[C] is adequate. 

On the other hand, as we saw, the fact that an execution falls in (B =>■ C) is 
controlled in a mixed fashion both by the random choices used by the algorithm 
and by the choices made by Player(2). Our third measure 'mf AeA P A [B =>■ C] is 
therefore adequate under only very special dynamics. For all practical purposes, we 
will deem it inadequate. 

The notions of "sole dependence" and "knowledge of player(2)". 

We introduced in page 54 the notions of event-schemas that depend solely of Player (2) 
and which are part of the knowledge of Player (2). We now formalize these notions. 
Both require to use with precision the model of a U/A structure presented in Def- 
inition 2.3.1, page 36, and the description of the associated probability schema 
(fi^t, Q A , Pa)aea presented in page 41. Recall in particular from the construction 
given in page 41 that the random variables Ai, A 3 , A 5 , . . . are the actions taken by 
Player (2) following its strategy A, and that the random variables A 2 , A 4 , . . . are the 
actions taken by Player(l) following its strategy it. 12 

Definition 3.2.1 An event schema B = (B A ) AeA is said to depend solely on 
Player (2) if, for every A £ A, conditioned on the a-field cr(Ai, A 3 , A 5 , . . .), 13 B A is 



We will formalize this statement later in Definition 3.2.2. 
We will formalize this statement later in Definition 3.2.1. 

127 



"Eventhough sharing the same notation A, the notion of actions Ai,A2,... is distinct from 
the notion of set of admissible adversaries A = {■Aj}jeJ- Note also that, eventhough there is no 
subscript A to emphasize that fact, the random variables Ak , Sk , Xk , Yk ', k > 1 defined in page 41 
are defined with respect to a given adversary A. 

We cannot say "conditioned on the values taken by Ai,A2,..." because there are in general 
infinitely many Ak and we cannot fix all of them when conditioning. We therefore have to resort 
to the more general notion of conditioning with respect to a fr-field. (See [56], page 211. See also 
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independent of the a-field cr(A 2 , A 4 , A 4 , . . .). 

Recall that Qa is by definition equal to cr(A k ; k > l). 14 Hence the previous condition 
is equivalent to: "conditioned on a(Ai,A 3 ,A 5 , . . .), Ba is independent of Qa" • 

Note also that the independence condition of this definition is trivially verified if 
Bj( can be characterized solely in terms of the actions of Player (2) i.e., if Ba £ 
cr(Ai, A 3 , A 5 , . . .). Indeed, in that case, when conditioned on cr(Ai, A 3 , A 5 , . . .), Ba 
"is a constant" and hence independent of Qa- 15 This is a satisfactory fact: we 
would expect that events that depend syntactically only on the actions Ai,A 3 , . . . 
of Player (2) do also "depend solely on Player(2) v in the sense of Definition 3.2.1! 
Our more complex definition takes into account that some events B might not be 
expressible uniquely in terms of the random variables Ai,A 3 ,... but still result 
in adequate measures of the type 'mfAeA,p A [B]=i Pa[C] when enforcing B. 16 We 
therefore provide now some motivations and justifications at how our definition 
captures that fact. 

As we just recalled, we introduced the notion of an event B "depending solely 
on" Player (2) to justify the adequacy of measures where Player (2) enforces the 
precondition B. The conditional independence of B and of the random choices of 
the algorithm ensures that, eventhough the definition of B might also involve the 
choices of the algorithm, A 2 , A 4 , . . ., these choices do not influence whether B occurs 
or not. Hence the occurrence of B depends only on the way values are allocated 
to Ai,A 3 , . . ., i.e., on the adversary. (Recall that, in Definition 2.3.1, page 36, we 
defined an adversary to be a family A = (Q y ,Gy,Py) y eY i- e -? the family of laws 17 of 
the random variables Ai,A 3 ,...) Therefore restricting the analysis to within B (the 
precondition of "if B then C") corresponds to considering only adversaries ensuring 
that B occurs i.e., such that -FU[-B] = 1. 

This shows that the measure 'mfAeA,p A [B]=i Pa[C] is an adequate formalization of 
"the probability of C under condition B v if B depends solely on Player (2). 



the footnote 3 above.) 

See page 41. 
15 A formal proof of this fact is as follows. The formal definition of conditional expectations 
recalled in footnote 3 expresses that, for every / £ L (dP), the conditional expectation E[f | £/'] 
is characterized by the property: Vc/> £ L (dP) C\ Q' ' , E[(j>f] = E\A E[f | Q']\ . Hence, for every 
<t> £ L 2 (dP) n Q' and every g £ L 2 (dP), E[cf>fg] = E[cf>E[fg \ Q']]. On the other hand, if by 
assumption / is in Q' we also have E[(j>fg] = E \<f>f E[g | Q']\ . Hence, in that case, Vc/> £ L (dP) C\ 
g', E[<pE[fg | g']] =E[<PfE[g \ Q']\ . This implies that E[fg \ Q'] = fE[g \ Q'] = E[f \ Q']E\g \ g'] 
P-almost surely. As g is arbitrary in L (dP) this precisely means that, conditioned on £/' , / is 
independent of £/. 

See our discussion about adequate measures in page 53. 

See Definition 8.1.2, page 198, for a definition of of the notion of law of a random variable. 
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We conclude this discussion about events "depending solely" of Player (2) with two 
caveats. To begin, note that even if an event-schema depends solely on Player(2), 
there might exist no strategy A such that -FU[-B] = 1. The reason is that the actions 
A k are random variables and hence not in the full control of Player (2). 

This brings us to the second point. A special but important case is when, as is 
the assumption in this chapter, the strategies of Player (2) are all deterministic. In 
that case, each action A k taken by Player (2) depends deterministically on the view 
Y k : Y k represents the knowledge held by Player (2) at level k. Hence, in this case, 
the condition presented in Definition 3.2.1 is equivalent to Y 1 ,Y 25 --- determining 
completely B. Nevertheless it is possible that B be not characterized by a single 
variable Y k . In that case, there is no point k at which Player (2) knows B, eventhough 
B depends solely on that player. A justification for this apparent paradox is that 
the sequence of views of Player (2) characterizes B, but Player (2) lacks at each 
single point the possibility to assess more then one value of the sequence {Y k ) ke ^. 
We can encounter such situations - where some B depends solely on the views of 
Player (2) but where Player (2) does not "know" it - if, for instance, Player (2) does 
not remember completely the past (i.e., if the the past values Yi, . . .,Y k _i are not 
recorded in the view Y k ) or if B depends on infinitely many views Y k . 

Definition 3.2.2 An event schema (B A ) AeA is sa id t° be part of the knowledge of 
Player (2) if there exist a (random) step number k A such that B A is measurable with 
respect to the view Y kA . 

By definition, B A is measurable with respect to Y kA if there is a (deterministic) 
function f A such that the indicator of B A is equal to f A (Y kA ). As mentioned in the 
caveat above, the knowledge accessible to Player (2) at each point k is completely 
described by the variable Y k . Our definition therefore formalizes well that B is part 
of the knowledge of Player(2). We allow k A to be random to take into account the 
fact that information becomes available to the players at random times. 



Composition of adequate correctness-measures. 

The two types of measure inf Ae A . Pa [b]> P a [C \ B] and mf AeA] p A[B]=1 P A [C] can 
be combined to yield an adequate composite measure 18 in the following situations. 
Player (2) holds some specific knowledge B x and uses this knowledge to enforce 
a condition B 2 , which depends solely on him, trying to minimize the probability 



See our discussion about adequate measures in page 53. 
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of occurrence of an event C . In this case, the probability of occurrence of C is 
adequately 18 measured by: 

inf PaICIBi]. 

A,P A [B 2 \B 1 ] = l 
-Pa[-Bi]>0 

We actually have to be more precise to ensure that this measure is adequate 18 . 
In Definition 3.2.1, the formalization of "B depends solely of Player(2) v is made 
(implicitly) in terms of the probability schema (O4, Qa-, Pa)aea- 19 In contrast, the 
formalization of LL B 2 depends solely on Player(2) v is made conditioned on _B l7 i.e., is 
made in terms of the probability schema 

(B 1>A , Qa n B 1>A , P A [ ■ }/PA[B 1 ,A]) AeA , 

where B 1 = (B 1>A ) A€A , Q A D B 1 = {C n B^C G Q A ) and where A 1 = {A G 
A; PaIB^ > 0}. ' 

We now generalize this construction. Our discussion involves a sequence of event- 
schemas Bi,B 2 , ■ ■ ■ To justify the validity of our argument we make the following 
assumption formalizing that, for every k, B k happens before B k+ i in the execution. 
(This requirement might possibly be relaxed and the argument generalized.) 

Assumption. There exists an increasing sequence of (random) values ni,n 2 ,... 
such that, for every k, B k G a(Y nk ,Y nk+1 , . . .,Y„ fc+1 _i). 

Assume that the natural dynamics 20 of the 11/ A structure ensure the following. 
Player (2) holds the knowledge of B±. Using this knowledge Player (2) decides single- 
handedly on B 2 : by assumption B 2 depends solely on Player(2). (As above the 
formal translation of this fact requires the use of the probability schema (Bi A , Q A P\ 
Bii Pa[ ' ]/Pa[Bi,a])a€A'-) Player (2) then observes B 3 and uses this knowledge to 
decide on some B A that depends solely on him ... We symbolically let 

B\ I B 2 —> B 3 I B 4 —> . . . 

denote such scenarios. To each scenario, we can associate an adequate correctness- 
measure by iterating the previous procedure. For instance, an adequate correctness 



The notion of probability schema is presented in Definition 2.4.1. 
The notion of natural dynamics is presented in page 54. 
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measure associated to a scenario B x \ B 2 — ► B 3 is given by: 

inf P A [C\B U B 3 ]. 

A,P A [B 3 \B 1 ,B 2 ]>0 

Pa[B 2 \B 1 ] = 1 

P A [B i]>0 

We thus obtain a whole family of (rather complex) adequate high-probability cor- 
rectness measures. A special but important case where we can easily write such 
adequate measures is when, for (each) odd index 2i — 1, the precondition B 2i _i is 
part of the knowledge of Player (2) and when B 2i is described in terms of the action 
taken next by Player (I). 21 Indeed, in that case, the precondition B 2i depends solely 
on Player (2) (conditioned on _B l5 . . . , B 2i _i). 



Summary and open questions about adequate measures. 

We saw that there are two extremes when formalizing a high-probability statement 
of the form "for all adversaries, if property B holds then property C holds with 
probability at least e." In one extreme, we restrict the analysis to within B, leaving 
Player (2) free to select the most damaging strategy it wishes. This leads to the 
measure 

MP A [C\B]. 

This measure might be "unfair" to Player(l) as it gives to Player (2) some knowledge 
that it might not receive otherwise according to the natural dynamics of the 11/ A 
structure considered. The other extreme is to require that the adversary ensures B 
with probability one. This leads to the measure 

inf P A [C]. 

A£A;P A [B] = 1 

This measure can be "unfair" to Player (2) as it forces that player to guaranty alone 
an event which might depend on both players. Any other high probability measure 
M formalizing the statement above must fall between these two measures: 

inf P A \C I B]< M < inf P A \C] . 

AeA;P A [B]>0 AeA;P A [B] = l 



We formalize here this statement. We will use the convenient labeling presented on page 65 to 
describe an execution: to = A\ (5i,Xi,li) A 1 (S 1 , X 1 ,Y 1 ) A2 (S^j-X^, I2) .... With these conven- 

^^^^^^^v^^^^^^^ ^^^^^^^v^^^^^^^ ^^^^^^N^^^^^^^ 

Player(2") Player(l) Player(2") 

tions a formal translation of our statement is that, for every A in A, there exists a (random) index 
kji such that B2i—i,A £ a (Y k ) and such that B2%,A G <T {^ L h A ) 
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It would be very interesting to be able to characterize the set of adequate measures 
of a given randomized algorithm. 

Existence. In particular, an interesting question is whether there always exists an 
adequate 22 formalization of the expression "the highest probability of C under con- 
dition B" . If not this would mean that some correctness statements are by nature 
ill-formed. In particular, we would like to know whether Rabin's property quoted 
in page 61 can be adequately formalized in connection with the 11/ A structure pre- 
sented on page 64. 

Completeness. We saw that the set of actions of Player (2) depended solely 23 of 
her. Combining such actions with events that are part of her knowledge 23 allowed us 
to derive (infinitely many) adequate measures associated to a randomized algorithm. 
Are all the adequate measures of this type? This would show that the method of 
conditioning by adversary and of probabilistic conditioning 24 are "basis" for all other 
adequate measures. 



3.3 Proving Lower Bounds 

The previous section was devoted to formalizing adequately a statement informally 
stated. We consider in this section the technical problem to provide a lower bound 
for an expression already formalized into the form inf^ G/l -fU[W \ I]. In general it is 
difficult to estimate directly this expression. Indeed recall that W and I are event 
schemas and that we actually have to estimate inf^ G/l Pa\Wa I I a ]• 

Let (0, Q, P) be the probability space associated to the random inputs i used by the 
algorithm. (Rabin's algorithm is using two independent coins so that this probability 
space is easily defined in that case.) Our method for proving a high probability cor- 
rectness property of the form -PUf^i] consists of proving successive lower bounds: 

P A [W\I] > PaIW^P] 



> P A [W r \I r ], 

where all the Wi and p are event schemas, and where the last two event schemas, W r 
and I r , are true events in Q and do not depend on A. The final term, Pa[ W r | P ], 



See our discussion about adequate measures in page 53. 
23 See Definitions 3.2.1 and 3.2.2. 
See page 54 
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is then evaluated (or bounded from below) using the distribution P. This method 
can be in practice rather difficult to implement as it involves disentangling the ways 
in which the random choices made by the processes affect the choices made by the 
adversary. 



3.4 Rabin's Algorithm 

The problem of mutual exclusion [16] involves allocating an indivisible, reusable 
resource among n competing processes. A mutual exclusion algorithm is said to 
guarantee progress 25 if it continues to allocate the resource as long as at least one 
process is requesting it. It guarantees no-lockout if every process that requests 
the resource eventually receives it. A mutual exclusion algorithm satisfies bounded 
waiting if there is a fixed upper bound on the number of times any competing 
process can be bypassed by any other process. In conjunction with the progress 
property, the bounded waiting property implies the no-lockout property. In 1982, 
Burns et al.[12] considered the mutual exclusion algorithm in a distributed setting 
where processes communicate through a shared read-modify-write variable. For 
this setting, they proved that any deterministic mutual exclusion algorithm that 
guarantees progress and bounded waiting requires that the shared variable take 
on at least n distinct values. Shortly thereafter, Rabin published a randomized 
mutual exclusion algorithm [49] for the same shared memory distributed setting. His 
algorithm guarantees progress using a shared variable that takes on only O(log n) 
values. 

It is quite easy to verify that Rabin's algorithm guarantees mutual exclusion and 
progress; in addition, however, Rabin claimed that his algorithm satisfies the fol- 
lowing informally-stated strong no-lockout property 26 . 

" If process i participates in a trying round of a run of a computation by 
the protocol and compatible with the adversary, together with < m— 1 < 
n other processes, then the probability that i enters the critical region at 
the end of that round is at least c/m, c ~ 2/3." (*) 

This property says that the algorithm guarantees an approximately equal chance of 
success to all processes that compete at the given round. Rabin argued in [49] that 



We give more formal definitions of these properties in Section 3.5. 

In the statement of this property, a "trying round" refers to the interval between two successive 
allocations of the resource, and the "critical region" refers to the interval during which a particular 
process has the resource allocated to it. A "critical region" is also called a "critical section". 
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a good randomized mutual exclusion algorithm should satisfy this strong no-lockout 
property, and in particular, that the probability of each process succeeding should 
depend inversely on to, the number of actual competitors at the given round. This 
dependence on m was claimed to be an important advantage of this algorithm over 
another algorithm developed by Ben-Or (also described in [49]); Ben-Or's algorithm 
is claimed to satisfy a weaker no-lockout property in which the probability of success 
is approximately c/n, where n is the total number of processes, i.e., the number of 
potential competitors. 

Rabin's algorithm uses a randomly-chosen round number to conduct a competition 
for each round. Within each round, competing processes choose lottery numbers 
randomly, according to a truncated geometric distribution. One of the processes 
drawing the largest lottery number for the round wins. Thus, randomness is used 
in two ways in this algorithm: for choosing the round numbers and choosing the 
lottery numbers. The detailed code for this algorithm appears in Figure 3.1. 

We begin our analysis by presenting three different formal versions of the no-lockout 
property. These three statements are of the form discussed in the introduction and 
give lower bounds on the (conditional) probability that a participating process wins 
the current round of competition. They differ by the nature of the events involved 
in probabilistic conditioning, those involved in conditioning by adversary and by the 
values of the lower bounds. 

Described in this formal style, neither of the two forms of conditioning - probabilistic 
conditioning and conditioning by adversary - provides an adequate formalization 27 
of the fact that m processes participate in the round. We show in Theorem 3.6.1 
that, if probabilistic conditioning is selected, then the adversary can use this fact in 
a simple way to lock out any process during any round. 

On the other hand, the weak c/n no-lockout property that was claimed for Ben-Or's 
algorithm involves only conditioning over events that describe the knowledge of the 
adversary at the end of previous round. We show in Theorems 3.6.2 and 3.6.4 that 
the algorithm suffers from a different flaw which bars it from satisfying even this 
property. 

We discuss here informally the meaning of this result. The idea in the design of 
the algorithm was to incorporate a mathematical procedure within a distributed 
context. This procedure allows one to select with high probability a unique random 
element from any set of at most n elements. It does so in an efficient way using 
a distribution of small support ("small" means here O(log n)) and is very similar 
to the approximate counting procedure of [20]. The mutual exclusion problem in a 



"adequate" in the sense of Section 3.2. 
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distributed system is also about selecting a unique element: specifically the prob- 
lem is to select in each trying round a unique process among a set of competing 
processes. In order to use the mathematical procedure for this end and select a true 
random participating process at each round and for all choices of the adversary, it 
is necessary to discard the old values left in the local variables by previous calls of 
the procedure. (If not, the adversary could take advantage of the existing values.) 
For this, another use of randomness was designed so that, with high probability, at 
each new round, all the participating processes would erase their old values when 
taking a step. 

Our results demonstrate that this use of randomness did not actually fulfill its 
purpose and that the adversary is able in some instances to use old lottery values 
and defeat the algorithm. 

In Theorem 3.6.6 we show that the two flaws revealed by our Theorems 3.6.1 and 
3.6.2 are at the center of the problem: if one restricts attention to executions where 
program variables are reset, and if we condition by adversary on the number m of 
participating processes then the strong bound does hold. Our proof, presented in 
Proposition 3.6.7, highlights the general difficulties encountered in our methodology 
when attempting to disentangle the probabilities from the influence of A. 

The algorithm of Ben- Or which is presented at the end of [49] is a modification of 
Rabin's algorithm that uses a shared variable of constant size. All the methods that 
we develop in the analysis of Rabin's algorithm apply to this algorithm and establish 
that Ben-Or's algorithm is similarly flawed and does not satisfy the l/2en no-lockout 
property claimed for it in [49]. Actually, in this setting, the shared variables can take 
only two values, which allows the adversary to lock out processes with probability 
one, as we show in Theorem 3.6.9. 

In a recent paper [36], Kushilevitz and Rabin use our results to produce a modi- 
fication of the algorithm, solving randomized mutual exclusion with log 2 n values. 
They solve the problem revealed by our Theorem 3.6.1 by conducting before round k 
the competition that results in the control of Crit by the end of round k. And they 
solve the problem revealed by our Theorem 3.6.2 by enforcing in the code that the 
program variables are reset to 0. 

The remainder of this chapter is organized as follows. Section 3.5 contains a descrip- 
tion of the mutual exclusion problem and formal definitions of the strong and weak 
no-lockout properties. Section 3.6 contains our results about the no-lockout proper- 
ties for Rabin's algorithm. It contains Theorems 3.6.1 and 3.6.2 which disprove in 
different ways the strong and weak no-lockout properties and Theorem 3.6.6 whose 
proof is is a model for our methodology: a careful analysis of this proof reveals ex- 
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actly the origin of the flaws stated in the two previous theorems. One of the uses of 
randomness in the algorithm was to disallow the adversary from knowing the value 
of the program variables. Our Theorems 3.6.2 and 3.6.8 express that this objective 
is not reached and that the adversary is able to infer (partially) the value of all 
the fields of the shared variable. Theorem 3.6.9 deals about the simpler setting of 
Ben-Or's algorithm. 

Some mathematical properties needed for the constructions of Section 3.6 are pre- 
sented in an appendix (Section 3.7). 



3.5 The Mutual Exclusion Problem 

The problem of mutual exclusion is that of continually arbitrating the exclusive 
ownership of a resource among a set of competing processes. The set of competing 
processes is taken from a universe of size n and changes with time. A solution to 
this problem is a distributed algorithm described by a program (code) C having the 
following properties. All involved processes run the same program C. C is partitioned 
into four regions, Try, Crit, Exit, and Rem which are run cyclically in this order 
by all processes executing C. A process in Crit is said to hold the resource. The 
indivisible property of the resource means that at any point of an execution, at most 
one process should be in Crit. 

3.5.1 Definition of Runs, Rounds, and Adversaries 

In this subsection, we define the notions of run, round, adversary, and fair adversary 
which we will use to define the properties of progress and no-lockout. 

A run p of a (partial) execution uj is a sequence of triplets {(pi, old x , newi), (p 2 , old 2 , 
new 2), ■ ■ ■ (pt, old t , new t ) . . .} indicating that process p t takes the t th step in uj and 
undergoes the region change old t — ► new t during this step (e.g., old t = new t = Try 
or old t = Try and new t = Crit). We say that uj is compatible with p. 

An adversary for the mutual exclusion problem is a mapping A from the set of 
finite runs to the set {1, . . .,n} that determines which process takes its next step 
as a function of the current partial run. That is, the adversary is only allowed to 
see the changes of regions. For every t and for every run p = {(pi,oldi,newi), 
(p 2 ,old 2 ,new 2 ),...}, A[{{pi,old l ,nev) l ), . . .,(p t ,old t ,new t )}] = p t+1 . We then say 
that p and A are compatible. 
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The associated II/A-structure. We show how these definitions can be formal- 
ized into a n/A-structure within the general model presented in Definition 2.3.1, 
page 36. Recall that we consider here only deterministic adversaries, i.e., adversaries 
for which, for every k, the k th action of Player(2), A k , is a deterministic function of 
the view Y k . 

To simplify the exposition we will slightly change the notations of Chapter 2, page 41, 
in the following way. We write here a random execution uj as 

u = A 1 (SuXuYj A[ (S[,X[,YI) A 2 (S 2 ,X 2 ,Y 2 ) . . . 



Player(2) Player(l) Player(2) 

A k is the k th action taken by Player(2). S k , X k and Y k are respectively the state 
of the system, the view of Player(l) and the view of Player (2) resulting after this 
action. Similarly we let A' k , S' k , X' k and Y k denote the k th action taken by Player(l), 
the state of the system, and the views of the two players resulting after this action. 

• The set of states, S , is the set of tuples containing the value of the program 
counters pc 1 , . . . ,pc n , the values of all the local variables and the value of the 
shared variable. 

• The actions A k take values in {1, . . . , n}. 

• The actions A' k are described by the code of the algorithm given in Figure 3.1, 
page 74. (We will not make these actions more explicit.) 

• The views X k take value in S X {1, . . . , n}. (If the view of Player(l) is (s, i), 
then i represents the process to take a step next.) 

• The views Y k take value in {runs of length (k — 1)} X {1, . . . , n}. (Y k = (y, i) 
means that the previous view of Player (2) was Y k-1 = y and Player (2) just 
selected i.) 

• The set of views X' k is equal to S. (Player(l) just remembers the state of the 
system after its step.) 

• The views Y k take value in {runs of length k}. 

The update functions are described as follows. Assume that (S k ,X k ,Y k ) = (s, (x, i), 
(y,i)). Then (S' k ,X' k ,Yl) = f(S k ,X k ,Y k ,A' k ) = (s' , s', (y, i, new t )), 2S where s' is the 
state of the system after the k th move of Player(l) and newi is the region reached by 



For simplicity we do not recall old, which is recorded in y. 
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process i. Similarly assume that (S' k ,X k ,Y k r ) = (s,x,y). Then (S k+ i,X k+ i,Y k+ i) = 
g(s, x, y, i) = (s, (x, i), (y, i)), where i is the process selected by Player (2) for round 
k + 1. 

This defines the II/A-structure associated to Rabin's randomized algorithm for mu- 
tual exclusion. The construction given in Chapter 2, page 36, defines the associated 
probability schema {^IaiGa-i Pa)aza over which we will conduct the analysis. 

In this model Player(l) "forgets" systematically all the past, knows the current 
state and learns what the last action of Player (2) is. By contrast, we will consider in 
Chapter 7 an example where Player(l) learns nothing about the moves of Player(2), 
consequently knows only partially the state, and remembers everything about its 
past actions. 

For every adversary A, an execution uj in 0^ is in Fair a if every process i in Try, 
Crit, or Exit is eventually provided by A with a step. This condition describes 
"normal" executions of the algorithm and says that processes can quit the compe- 
tition only in Rem. The number of states, actions and views being finite we can 
express Fair a as an expression involving (only) countably many rectangles. 29 This 
establishes that Fair a G Qa an d that the family Fair = (Fair^AeA is an event- 
schema. An adversary A is fair if the executions produced under the control of A 
are in Fair with probability one, i.e., if P^fFowr^] = 1. This definition was also given 
in Vardi [58], page 334. Player (2) is fair if every A G A is fair. 30 

In this chapter, we choose the set A of admissible adversaries to be the set of fair 
adversaries. 

A round of an execution is the part between two successive entrances to the critical 
section (or before the first entrance). More specifically, it is a maximal execution 
fragment of the given execution, containing one transition Try — ► Crit at the end 
of this fragment and no other transition Try — ► Crit. The round of a run is defined 



See page 42 for a definition of a rectangle and page 43 for a definition of an event-schema. 

The probabilistic notion of fairness allows more flexibility in the definition of adversaries then 
requiring that all executions be in Fair. The following example illustrates that fact. Consider two 
processes each running the simple code: "Flip a fair coin". This means that process i (i = 1 or 
2) flips a coin whenever allocated a step by Player(2). An execution is in Fair if both processes 
take infinitely many steps. Consider the adversary A defined by: "I. Allocate steps repeatedly 
to process f until Head comes up. Then allocate steps repeatedly to process 2 until Head comes 
up. Then go back to I and repeat." This adversary is fair in the probabilistic sense: Pj\[Fair\ = 1. 
Nevertheless it produces (with probability zero) some executions that are not in Fair. 
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similarly. For every k, we let round(k) denote the k th round. Formally, round(k) 
is a variable-schema 31 round(k) = (round A (k)) AeA : round^(k) is the random k th 
round of the generic execution obtained when the adversary is A. (For completeness 
we write round^(k) = _L if the execution has less then k rounds.) 

A process i participates in a round if i takes a step while being either in its trying 
section Try or at rest in its section Rem. Hence, for a participating process old, G 
Rem, Try and newi £ Try, Crit. 

3.5.2 The Progress and No-Lockout Properties 

Definition 3.5.1 An algorithm C that solves mutual exclusion guarantees progress 
if for all fair 32 adversaries there is no infinite execution in which, from some point 
on, at least one process is in its Try region (respectively its Exit region) and no 
transition Try — ► Crit (respectively Exit — ► Rem) occurs. 

Recall that the notion of fair adversary is probabilistic. But the notion of mutual ex- 
clusion is not probabilistic: we require that, for all fair adversaries and all executions 
oj in Fair A , oj have the property enunciated in Definition 3.5.1. 

We now turn towards the no-lockout property. This property is probabilistic. Its 
formal definition requires the following notation: 

For every adversary A, let X A denote any generic quantity whose value changes as 
the execution unfolds under the control of A (e.g., the value of a program variable). 
We let Xj((k) denote the value of X A just prior to the last step (Try — ► Crit) of 
the kth. round of the execution. As a special case of this general notation, we define 
the following. 

• T- > A(k) is the set of participating processes in round k. (Set Vj((k) = if uj 
has fewer then k rounds.) The notation Vj((k) is consistent with the general 
notation because the set of processes participating in round k is updated as 
round k progresses: in effect the definition of this set is complete only at the 
end of round k. (This fact is at the heart of our Theorem 3.6.1). 

• £.a(&) is the total number of steps that are taken by all the processes up to 
the end of round k. 



31 See Definition 2.4.1. 
The mention of the fairness is put here just as a reminder: recall that, in this chapter, all the 



admissible adversaries are fair. 
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• Af A {k) is the set of executions in which all the processes j participating in 
round k reinitialize their program variables Bj with a new value fij{k) during 
round k. (Af stands for New-values.) (3j(k); k = 1,2, . . ., j = 1, . . .,ra is a 
family of iid 33 random variable whose distribution is geometric truncated at 
log 2 ra +4 (see [49]). 



• 



For each i, Wi iA {k) denotes the set of executions in which process i enters the 
critical region at the end of round k. 



We consistently use the probability theory convention according to which, for any 
property S A , the set of executions {uj £ £l A : uj has property S A } is denoted as 
{S A }. Then: 

• For each step number t and each execution uj £ £l A we let it t iA {uj) denote the 
run compatible with the first t steps of uj. For any i-steps run p, {ir t A = p} 
represents the set of executions compatible with p. ({ir t A = p} = if p has 
fewer then t steps.) We will use itk,A in place of Kt(k) ,A to simplify notation. 

Note that the definition of it t A can be made independently of any adversary 
A, justifying the simpler notation it t . We nevertheless keep the subscript A to 
emphasize that, for every A, ~K t ,A ls defined on {SIa^Ga) which depends on A. 

• Similarly, for all m < n, {|P^t(A;)| = to} represents the set of executions having 
m processes participating in round k. 

For every A, The quantities N A {k), {K t ,A = p}, W iyA {k), {\V A {k)\ = to}, {i £ 
V A (k)} are sets of executions. We actually easily check that they are all events in 
the (T-field Q A . The care that we showed by keeping the reference to A in it t A is 
justified here by the fact that {ir t A = p} is an event in Q A which does depend on 
A. These families of events naturally lead to event-schemas Af(k), {ir t = p}, Wi(k), 
{\V(k)\ = m}, {i £ V(k)}. For instance, Af(k) = (Af A (k)) AeA and {vr t = p} = 
({ir tiA = p}) AeA . The analysis will consider these event schemas in connection with 
the probability schema (£l A , Q A , P a ) a ^a- 

We now present the various no-lockout properties that we want to study. All are 
possible formalizations of statement (*) given on page 61. Of great significance to us 
is their adequacy 34 : a measure which is not adequate does not confer valuable infor- 
mation about the algorithm studied. To simplify the discussion we will sometimes 



Recall that iid stands for "independent and identically distributed". 

See our discussion about the notion of adequate measures on page 53. We also review that 



notion shortly here. 
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use the notation C, Bi, B 2 , B 3 and B A in place of Wi(k), {i G V(k)}, {itu-i = /°} 5 
{|P(£;)| = rn}, and Af(k), respectively. As suggested by our notation, we will con- 
sider C to be the target property 35 and _B l5 B 2 , B 3 and B A to be the preconditions. 
The target property can be considered only in conjunction with the precondition 
B x . Hence all the measures we will consider will have B\ as a precondition. The 
other preconditions can be introduced or omitted, each choice corresponding to a 
different measure (actually to two different measures as we now discuss). 

We argued at the beginning of this chapter that a measure reflects an actual prop- 
erty of the II/A-structure only if it does not perturb the dynamics of the game 
between Player (X) and Player(2). We then say that the measure is adequate. All 
the measures that we will consider formalize the preconditions using either proba- 
bilistic conditioning or conditioning by adversary. 36 (At this point we know of no 
other method to construct adequate measures.) As we will see neither of these two 
methods allows to treat adequately the precondition B 3 . This is unfortunate be- 
cause, as is mentioned in [49], a "good" measure of no-lockout should be expressed 
in terms of to, the actual number of participating processes in a round. In spite 
of this fact we will treat the preconditions in the most adequate way, envisioning 
various alternatives when no adequate formulation is available. 

We have actually in mind to compute the probability of the target Wi{k) at different 
(random) points s k of the execution. The execution-fragment previous to s k is 
(obviously) determined at the point s k . The definition of Rabin's II/A-structure 
implies that Player (2) then knows the run associated to that execution-fragment. 
As is explained on page 54, the natural way to account for this situation is to use 
probabilistic conditioning on the knowledge held by Player (2) at that point s k . We 
will consider two cases, when s k is the beginning of the execution and when it is the 
beginning of round k. In the latter case the knowledge held by Player(2)is the past 
run p. Hence the adequate formalization of this case is obtained by probabilistically 
conditioning on B 2 = {^ k -i = p}. In the former case - when s k is the beginning 
of the execution - there is no past and the corresponding adequate formalization 
consists in simply omitting B 2 from the measure. 

We now turn to B x = {i G V(k)}. As mentioned above the target C = Wi{k) can 
be considered only when this precondition is considered. In this case the situation 
is not as clear as for B 2 : the fact that a process i participates in round k depends 
on both the strategy A used by Player (2) and on the random values drawn by the 
algorithm during the round. Indeed, on the one hand i can participates only if 

The notions of "target property" and "precondition" are denned on page 48. 
These notions are defined on page 54. 
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Player (2) plans to schedule it. On the other hand, i can also participate only if no 
process scheduled before its turn comes does succeed into Crit. This depends (in 
part) on the random lottery values drawn by these processes. 

There is one process though, for which the situation is unambiguous: the first 
one scheduled in round k by Player (2). This one depends solely on Player (2) (in 
the sense of Definition 3.2.1). When proving negative results (i.e., disproving the 
correctness of the algorithm) we can therefore consider that process: if correct, the 
algorithm should in particular ensure a good success rate for this specific process. 

On the other hand, when proving positive results (i.e., proving that the algorithm 
satisfies some correctness-measure) we will, by default of an adequate measure, 
give Player (2) more power then it would in any adequate situation. Indeed, the 
correctness of the algorithm in that case implies the correctness for any adequate 
measure, if any exists. We achieve this by letting Player (2) know the identity of the 
process i with respect to which the test is conducted. Formally, this means that we 
use probabilistic conditioning on {i £ V(k)}. 

We now turn to B 3 , the most important character in the cast of _B's. (Recall again 
that the whole purpose of the algorithm is to achieve a measure of fairness with 
respect to the m currently participating processes.) Unfortunately, in that case, we 
have no means in our panoply to interpret adequately this precondition ... unless 
m = 1, in which case statement (*) of page 61 is vacuously true. Indeed, consider 
first probabilistically conditioning on B 3 . This means, as we saw, letting Player (2) 
know the number of participating processes and then letting it act as it wishes 
(provided that Player (2) allows with non-zero probability that |P(A;)| = to). This 
gives a definite power to Player (2): Player (2) is in fact the main power in the 
determination of m. Our Theorem 3.6.1 expresses that fact and shows that the 
algorithm is incorrect ... for the inadequate correctness measure considered. 

The other possibility at our disposal is to condition by adversary 37 on B 3 . This 
does not provide an adequate measure either. As we will show in Lemma 3.6.5 this 
constrains in essence Player (2) to give steps to all participating processes when the 
critical section is still closed. This implies in particular that Player (2) cannot play 
on the order according to which it schedules the processes: that is precisely the 
weapon used by Player (2) to defeat the previous measure. This restriction can be 
viewed as "unfair" to Player (2): it ties its hands in a way that does not correspond 
to the natural dynamics of Rabin's II/A-structure. Nevertheless our Theorem 3.6.2 
shows that this over-constrained Player (2) still manages to defeat the algorithm. 



See page 54. 
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The measure considered being the most restrictive towards Player (2), any measure 
formalizing adequately that |P(A;)| = m (if any exists) would similarly yield a defeat 
of the algorithm. 

This brings us to the last of the B event-schemas: B A = Af(k). This event is 
similarly neither part of the knowledge of Player(2) 38 at the beginning of round 
k nor depending solely on him. 39 Thus, as we already saw several times, both 
methods of probabilistic conditioning and conditioning by adversary are inadequate. 
The most unfavorable to Player(l) is the probabilistic conditioning method. A 
correctness result in that case will therefore imply correctness for any other adequate 
formalization of Af(k), if any exits. This is why probabilistic conditioning is used in 
Theorem 3.6.6. 



We are now at last in a position to present the various measures. We use the following 
notations. The term weak refers to the fact that a 1/ra lower bound on the probabil- 
ity is sought. The term strong refers to a 1/to lower bound. The terms/notations i, 
run, m and renew refer to B x , B 2 , B 3 and B A respectively. The term knowing refers 
to a probabilistic conditioning. For instance (run, i, m and rene«?)-knowing summa- 
rizes that probabilistic conditioning is performed on Bi,B 2 ,B 3 and B A . The term 
imposing refers to a conditioning by adversary. For instance i-imposing summarizes 
that conditioning by adversary is performed on B x ■ 

The first two definitions involve evaluating the probabilities "at the beginning of 
round k v . The measure mf^eA' P^[Wi(k) \ Xk-i = p] used in the first definition 
is adequate (in the sense defined on page 53). It corresponds to a probabilistic 
measuring obtained for Player(2) sitting at the beginning of round k (and hence 
knowing the past (k — l)-run p) and scheduling the first step of round k to process i. 
As discussed on page 70, this measure is too specific to provide a relevant measure 
of performance of the algorithm. Nevertheless it is a good measure to establish a 
negative result: if correct, the algorithm should in particular ensure a good success 
rate for the specific process i. The measures used in the other two definitions are not 
adequate (in the sense defined on page 53). We argue this point after the definitions. 

Definition 3.5.2 (Weak, Run-knowing, i-imposing, Probabilistic no-lock- 
out) A solution to the mutual exclusion problem satisfies weak, run-knowing, i- 
imposing probabilistic no-lockout whenever there exists a constant c such that, for 

38 See Definition 3.2.2. 
39 See Definition 3.2.1. 
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every k > 1, every (k — l)-round run p and every process i, 

inf PA[Wi{k) | ir k _ i = p}> c/n. 

A,P A [ieV(k) I 7r fe _ 1 = / o] =1 

P A [Tr k - 1=P ]>0 

Definition 3.5.3 (Strong, Run & m-knowing, i-imposing, Probabilistic no- 
lockout) The same as in Definition 3.5.2 except that: 

inf P A [W t (k) | ir k _ 1 =p, \V(k)\ = m] >c/m. 

A,P A [ieV(k) I 7Tfe_ 1 =p, \V(k)\=m]=l 
P A [Kk-i=P, \T(k)\=m]>0 

The next definition is the transcription of the previous one for the case where the 
probability is "computed at the beginning of the execution" (i.e., s k = for all k). 

Definition 3.5.4 (Strong, m-knowing, i-imposing, Probabilistic no-lockout) 

The same as in Definition 3.5.2 except that: 

inf P A [Wi(k) \ m=\V(k)\]>c/m. 

A,P A [ieV(k) | \V(k)\=m]=l 
P A [\T(k)\=m]>0 

We argue that the last two definitions are not adequate: both involve probabilis- 
tically conditioning on the number m of participating processes in round k. As 
mentioned above, the two definitions correspond to Player(2) sitting either at the 
beginning of round k or at the beginning of the execution. In both situations, the 
value of |P(A;)| is not part of the knowledge 40 of Player(2). Therefore probabilistic 
conditioning on the value m of |P(A;)| yields an inadequate measure of performance. 

By integration over p we see that an algorithm having the property of Definition 3.5.3 
is stronger then one having the property of Definition 3.5.4. Equivalently, an adver- 
sary able to falsify Property 3.5.4 is stronger then one able to falsify Property 3.5.3. 



3.6 Our Results 

Here, we give a little more detail about the operation of Rabin's algorithm than 
we gave earlier in the introduction. At each round k a new round number R is 



D See Definition 3.2.2. 
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selected at random (uniformly among 100 values). The algorithm ensures that any 
process i that has already participated in the current round has i? 8 - = R, and so 
passes a test that verifies this. The variable R acts as an "eraser" of the past: 
with high probability, a newly participating process does not pass this test and 
consequently chooses a new random number for its lottery value Bi. The distribution 
used for this purpose is a geometric distribution that is truncated at b = log 2 ra + 4: 
P[(3j(k) = I] = 2~ l for I <b— 1. The first process that checks that its lottery value 
is the highest obtained so far in the round, at a point when the critical section is 
unoccupied, takes possession of the critical section. At this point the shared variable 
is reinitialized and a new round begins. 

The algorithm has the following two features. First, any participating process i 
reinitializes its variable Bi at most once per round. Second, the process winning 
the competition takes at most two steps (and at least one) after the point f k of 
the round at which the critical section becomes free. Equivalently, a process i that 
takes two steps after f k and does not win the competition cannot hold the current 
maximal lottery value. (After having taken a step in round k a process i must hold 
the current round number i.e., Ri(k) = R(k). On the other hand, the semaphore S 
is set to after f k . If i held the highest lottery value at its second step after f k it 
would pass all three tests in the code and enter the critical section.) We will take 
advantage of this last property in our constructions. 

We are now ready to state our results. The first result states that the strong m- 
knowing correctness property does not hold unless n < 2. 

Theorem 3.6.1 The algorithm does not have the strong no-lockout property of Defi- 
nition (3.5.4) (and hence of Definition 3.5.3). Indeed, if n > 3, there is an adversary 
A such that, for all rounds k, for all to, 2 < m < n, 

PAiWiik) I m= \V(k)\] =0 
P A [ieV(k) I m= \V{k)\] = 1 
. P A [m=\V(k)\}>0. 

Proof. Assume first that 2 < m < n — 1. Consider the following adversary A. A 
does not use its knowledge about the past run p (which is granted to Player(2) by the 
11/ A- dynamics), gives one step to process 1 while the critical section is occupied, 
waits for Exit and then adopts the schedule 2, 2, 3, 3, . . ., ra, ra, 1. This schedule 
brings round k to its end, because of the second property mentioned above (i.e., 
all processes are scheduled for two steps, one of which when the critical section is 
empty). This adversary is such that m wins with non zero probability i.e., P A [m = 
\V{k)\] > 0. Also 1 is scheduled first so that, obviously, P A [1 G V(k) \ m = \V{k)\] = 
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Shared variable: V = (S,B,R), where: 
S e {0,1}, initially 
B e {0, 1, . . . , [log n\ + 4}, initially 
R G {0, 2, . . . , 99}, initially random 

Code for i: 

Local variables: 

Bi e {0, . . ., flogn] + 4}, initially 
Ri e {0,1,..., 99}, initially _L 
Code: 
while V ^ (0,Bi,Ri) do 

if (V.R ^ Ri) or (V.B < B { ) then 
Bi <— random 
V.B <- max(V.B,Bi) 
Ri ^V.R 
unlock; lock; 
V <— (1, 0, random) 
unlock; 

** Critical Region ** 
lock; 
V.S ^0 

Bi ^0 

unlock; 

** Remainder Region ** 

lock; 



Figure 3.1: Rabin's Algorithm 
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1. But, for this adversary, |P(A;)| = m happens exactly when process m wins so that 
PAW^k) | m = \P(k)\] = 0. 

Consider now the case where m = n. We consider then the adversary which gives 
one step to process 2 while the critical section is occupied, waits for Exit and then 
adopts the schedule 1,1,3,3,..., n, n, 2. As above, this schedule brings round k to 
its end. Similarly, -FUfl^^)! = n] > 0, namely when 2 holds the highest lottery 
value. Also, 1 is scheduled with certainty. We now show that 1 must have a smaller 
lottery then 2 and hence cannot win access to Crit. Indeed, otherwise 1 would win 
and |P(A;)| would be equal to 2. This is a contradiction as we assume that |P(A;)| is 
n and as, by assumption, n is bigger then 2. □ 

The previous result is not too surprising in the light of our previous discussion. The 
measure 

inf PaW^) J m = \V{k)\] 

A,P A [ leV(k) | m = \T(k)\ ] =1 
P A [\T(k)\=m]>0 

is not adequate and Player (2) punishes us for using it: in "normal times", i.e., under 
the dynamics of the U/A structure, Player (2) is provided with only incomplete 
information about the past, and definitely no information about the future. But 
our inadequate measure gives her the future information |P(A;)| = to, allowing her 
to target a specific strategy against any process. 

We now give in Theorem 3.6.2 the more damaging result, stating (1) that, in spite 
of the randomization introduced in the round number variable R, Player (2) is able 
to infer the values held in the local variables and (2) that it is able to use this 
knowledge to lock out a process with probability exponentially close to 1. This result 
is truly damaging because the measure used is adequate: our result expresses that 
the algorithm is "naturally" incapable to withstand the machinations of Player(2). 

Theorem 3.6.2 There exists a constant c < 1, an adversary A, a round k and a 
k — 1-round run p such that: 



32 



c 



' PA[W l (k)\* k _ l = p} <e 

p a [i e V(k) \ tt,., = p] = 1 

Pa[^-i = p]>0. 

We need the following definition in the proof. 

Definition 3.6.1 Let I be a round. Assume that, during round I, Player (2) adopts 
the following strategy. R first waits for the critical section to become free, then gives 
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one step to process j and then two steps (in any order) to s other processes. (We 
will call these test-processes .) Assume that at this point the critical section is still 
available (so that round I is not over). We then say that process j is an s-survivor 
(at round I). 

The idea behind this notion is that, by manufacturing survivors, Player(2)is able 
to select processes having high lottery values. We now describe in more detail the 
selection of survivors and formalize this last fact. 

In the following we will consider an adversary constructing sequentially a family 
of s-survivors for the four values s = 2 log2n+t ; t = — 1,...,— 5. Whenever the 
adversary manages to select a new survivor it stores it, i.e, does not allocates it 
any further step until the selection of survivors is completed. (A actually allocates 
steps to selected survivors, but only very rarely, to comply with fairness. Rarely 
means for instance once every nT 2 steps, where T is the expected time to select 
an ra/2-survivor.) By doing so, A reduces the pool of test-processes still available. 
We assume that, at any point in the selection process, the adversary selects the 
test-processes at random among the set of processes still available. (The adversary 
could be more sophisticated then random, but this is not needed.) Note that a new 
s-survivor can be constructed with probability one whenever the available pool has 
size at least s + 1: it suffices to reiterate the selection process until the selection 
completes successfully. 

Lemma 3.6.3 There is a constants d such that for any t = —5, . . ., —1, for any 
2 lo §2 n +* -survivor j , for any a = 0, . . . , 5 

P A [Bj(l) = logn + t + a]> d. 

Proof. Let s denote 2 logn+ *. Let j be an s-survivor and &i,&2v • • ? h be the test- 
processes used in its selection. Assume also that j drew a new value Bj(l) = fij{l) 
(this happens with probability q± = .99 .) Remark that Bj(l) = Max{ B il (l), . . ., 
Bi s (l),Bj(l)}: if this were not the case, one of the test-processes would have entered 
Crit. As the test processes are selected at random, each of them has with probability 
.99 a round number different from R(l) and hence draws a new lottery number fij{l). 
Hence, with high probability q 2 > 0, 90% of them do so. The other of them keep 
their old lottery value Bj(l — 1): this value, being old, has lost in previous rounds 
and is therefore stochastically smaller 41 then a new value /3,(/). (An application 



A real random variable X is stochastically smaller then another one Y (we write that: X <c Y) 
exactly when, for all x £ K, P[X > x ] < P[Y > x ]. Hence, if X < Y in the usual sense, it is also 
stochastically smaller. 
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of Lemma 8.1.5 formalizes this.) Hence, with probability at least q x q 2 we have the 
following stochastic inequality: 

Maxl^/), . . . , /3 S . 90/100 } < c Bj(l) < c Maxj^Z), . . . , /3 S+1 (Z)}. 

Corollary 3.7.4 then shows that, for a = 0,...,5, with probability at least qiq 2 , 
Pa[Bj{1) = log 2 s + a] > fe for some constant q 3 (q 3 is close to 0.01). Hence, with 
probability at least d = q\q 2 qs, Bj(l) is equal to log 2 s + a. □ 

Proof of Theorem 3.6.2. The adversary uses a preparation phase to select and 
store some processes having high lottery values. We will, by abuse of language, 
identify this phase with the run p which corresponds to it. When this preparation 
phase is over, round k begins. 

Preparation phase p: For each of the five values log 2 ra + i, t = —5, . . . , — 1, A selects in 
the preparation phase many ("many" means ra/20 for t = —5, . . . , —2 and 6ra/20 for 
t = —1) 2 g2n+ *-survivors. Let Si denote the set of all the survivors thus selected. 
(Note that 15*11= ra/2 so that we have enough processes to conduct this selection). 
By partitioning the set of 2 log 2 n_1 - survivors into six sets of equal size, for each of 
the ten values t = —5, . . .,4, A has then secured the existence of ra/20 processes 
whose lottery value is log 2 n + t with probability bigger then d. (By Lemma 3.6.3.) 

Round k: While the critical section is busy, A gives a step to each of the ra/2 processes 
from the set S 2 that it did not select in phase p. (We can without loss of generality 
assume that process 1 is in that set S 2 : hence Pj([i G V{k)] = 1 which was to be 
verified.) When this is done, with probability at least 1 — 2 -32 (see Corollary 3.7.2) 
the program variable B holds a value bigger or equal then log 2 ra — 5. The adversary 
then waits for the critical section to become free and gives steps to the processes 
of 5i it selected in phase p. A process in S 2 can win access to the critical section 
only if the maximum lottery value B S2 = Max^ e S2 Bj of all the processes in S 2 is 
strictly less then log 2 ra — 5 or if no process of Si holds both the correct round number 
R(k) and the lottery number B S2 . This consideration gives the bound predicted in 
Theorem 3.6.2 with c = (1 - (Z/100) 1 / 20 . □ 

The lesson brought by this last proof is that the variable R does not act as an eraser 
of the past as it was originally believed and that the adversary can correspondingly 
use old values to defeat the algorithm. 

Furthermore, our proof demonstrates that there is an adversary that can lock out, 
with probability exponentially close to 1, an arbitrary set of ra/2 processes during 
some round. With a slight improvement we can derive an adversary that will succeed 
in locking out (with probability exponentially close to 1) a given set S 3 of, for 
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example, ra/100 processes at all rounds: we just need to remark that the adversary 
can do without this set S 3 during the preparation phase p. The adversary would 
then alternate preparation phases pi,p 2 ,... with rounds ki,k 2 ,... The set S 3 of 
processes would be given steps only during rounds ki, k 2 , ■ ■ ■ and would be locked 
out at each time with probability exponentially close to 1. 

In view of our counterexample we might think that increasing the size of the shared 
variable might yield a solution. For instance, if the geometric distribution used by 
the algorithm is truncated at the value 6 = 2 log 2 ra instead of log 2 ra + 4, then the 
adversary is not able as before to ensure a lower bound on the probability that an 
ra/2-survivor holds b as its lottery value. (The probability is given by Theorem 3.7.1 
with x = logra.) Then the argument of the previous proof does not hold anymore. 
Nevertheless, the next theorem establishes that raising the size of the shared variable 
does not help as long as the size stays sub-linear. But this is exactly the theoretical 
result the algorithm was supposed to achieve. (Recall the ra-lower bound of [12] 
in the deterministic case.) Furthermore, the remark made above applies here also: 
a set of processes of linear size can be locked out at each time with probability 
arbitrarily close to 1. 

Theorem 3.6.4 Suppose that we modify the algorithm so that the set of possible 
round numbers used has size r and that the set of possible lottery numbers has size 
b (log 2 n + 4 < b < n). Then there exists positive constants c x and c 2 , an adversary 
A, and a run p such that 

PAlW^k) | Tiw = p,le V{k) } < e" 32 + e~ e ^ r + c 2 ^ 

p A [ieV(k)\Tr k _ 1 = p] = i 
iMT*-i = p] > o. 

Proof. We consider the adversary A described in the proof of theorem 3.6.2: for 
t = —5, . . ., —2, A prepares a set T t of 2 g2n+ *-survivors, each of size ra/20, and a 
set T_i of 2 log2n_1 -survivors; the size of T_ x is 6/20ra. (We can as before think of 
this set as being partitioned into six different sets.) We let r/ stand for 6/20 in the 
sequel. 

Let pi denote the probability that process 1 holds / as its lottery value after having 
taken a step in round k. For any process j in 5_i let also q { denote the probability 
that process j holds / as its lottery value at the end of the preparation phase p. 

The same reasoning as in Theorem 3.6.2 then leads to the inequality: 

PAw 1 {k)\-K h _ 1 = P , iev(k)] 

<e- 32 + (l-e- 32 )(l-rf/r)"/ 20 + ]T Pl (l - ^f n . 



3.6. Our Results 79 

Write / = log 2 ra + x — 1 = log 2 (ra/2) + x. Then, as is seen in the proof of Corol- 
lary 3.7.4, qi = e~ 2 2 1_< = for some ( £ (x, x + 1). For / > log 2 n + 5, x is at least 6 
and e~ 2 ~ 1 so that g ; ~ 2 1_c > 2 1 ~ x . On the other hand p ; = 2"' = 2~ x+1 /n. 

Define ^0) = e - 2l ~^ n ' r so that ^'0) = e- 2l ~^ n l r 2 l - x r,n/r. Then: 

£ p m (i-^r < 2/»^2-(i-^r 

;>log 2 + 5 a;>6 



< 2/ra^2" , V 



:c>6 

l/n^2 1 -"e-(^" n ) 



:c>6 

r 

i2 






< — - / ip'(x)dx 
■qn 2 J 5 

= —MT 

- ^[1 - e- 2 " 4 " n/r ] 



< 



T]Tl 

r 
r/n 2 
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The next result, Theorem 3.6.6, shows that the two flaws exhibited in Theorems 3.6.1 
and 3.6.2 are at the core of the problem: the algorithm does have the strong no- 
lockout property when we condition by adversary 42 on the property {|P(A;)| = to} 
and when we force the algorithm to draw new values for the modified internal 
variables. 

Conditioning by adversary specifically solves the problem expressed by Theorem 3.6.1: 
the measure analyzed in that theorem is inadequate 43 and allows too much knowl- 
edge to Player (2). On the other hand, forcing the adversary to reset to new values 
the internal variables of the participating processes resolves the problem revealed 
by (the proof of) Theorem 3.6.2. We will prove these facts in Theorem 3.6.6 for 
a slightly modified version of the algorithm. Recall in effect that the code given 
in Page 74 is optimized by making a participating process i draw a new lottery 

See page 54 for a definition of conditioning by adversary. 
See page 53 for a discussion of adequate measures. 
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number when it is detected that V.B < Bi. For simplicity, we will consider the 
"de-optimized" version of the code in which only the test V.R j^ Ri ? causes of a 
new drawing to occur. It is clear that a correctness statement for that de-optimized 
algorithm implies a similar result for the original algorithm. 

We proved that result before we were fully aware of the notion of adequate measures. 
Our original result is presented in Proposition 3.6.7 and is based on the notion of 
restricted adversary presented in Definition 3.6.2. As is shown in Lemma 3.6.5, a 
restricted adversary is exactly one that decides with probability one the set of par- 
ticipating processes. This result easily establishes the equivalence of Theorem 3.6.6 
and Proposition 3.6.7. 

Definition 3.6.2 A step taken after the time at which Crit becomes free in round 
k is called a A; -real step. We say that an adversary is A; -restricted when, in round k, 
the set of participating processes is composed exactly of the set of processes scheduled 
when Crit is closed, along with the first process taking a k-real step. (That process 
might have already taken a step when Crit was closed.) An adversary is said to be 
restricted when it is k -restricted for every k. 

Notation. We will use the notation A 1 (as opposed to A) in the following arguments 
to emphasize when the adversaries considered are ^-restricted. 

Lemma 3.6.5 For every process i, for every round k > 1, and for every (k — 1)- 
round run p, AA 

{A 1 ; A' is k-restricted and P A , \ \V{k)\ = m, i £ V(k) | Af(k), ir k _ l = p] > j 
= {A; P A [\V(k)\ = m, i£V(k) | A/-(£0,7r,_ 1 = /O ] = l} . 

Proof. Note first that, as by assumption an adversary is deterministic, random- 
ness can affect the decisions of Player (2) only through the information Player (2) 
receives from Player(l): the strategy of Player(l) - i.e., the algorithm - is indeed 
randomized. A moment of thought based on the description of the function / given 
on page 65 shows furthermore that, for Player (2), the only visible affects of random- 
ness are whether a process in Try or Rem enters in Crit when scheduled while the 
critical section is free. In particular, in round k Player (2) follows a deterministic 
behavior until it learns the region new t (either Try or Crit) reached by the first 



'Using Convention 8.1.1, page 198, we set P[B|A] = whenever P[A] = 0. 
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process i x scheduled to take a £;-real step. We will use this fact in both directions 
of the proof. 

For a ^-restricted adversary, the set V{k) is by definition defined during that pe- 
riod where A behaves deterministically. This implies that, for every ^-restricted 
adversary A', we have -FU'fl^WI = to, i G V{k) \ Af(k), Xk-i = p] > only if 
P4/[|P(A;)| = to, i G V(k) | N(k), 7r fc _! = p] = 1. This establishes that 

\A'; A' is ^-restricted and P A \\V{k)\ = to, i G V{k) \ M(k), vr^ = p] > j 

C {A;P A [\V(k)\ = m,ieV(k) | AT(k), 7r,_ 1 = /0 ] = l} . 

We now show the converse inclusion. Consider some adversary .4 such that P4[|7-'(A;)|- 
= m, i G V{k) | Af(k), Xk-i = p] = 1 f° r some value to. By the property 
mentioned at the beginning of the proof, the adversary follows a deterministic 
behavior until the first A;-real step. Call i x the process taking that first A;-real 
step. Let / be the number of processes scheduled up to that point (including 
i\). Obviously / < m. Remark that (conditioned on Af{k) and Xk-i = p) i x en- 
ters Crit with some non-zero probability when taking its first A;-real step. This 
means that -FUfl^^)! = I, i €. V(k) \ Af(k), Xk-i = p] > 0. The assumption 
P4[|P(A;)| = to, i G V(k) | N(k), 7r fc _! = p] = 1 then implies that / = m. This 
precisely means that A is ^-restricted. □ 

Theorem 3.6.6 The algorithm satisfies strong, run and renew-knowing, i and in- 
imposing probabilistic no-lockout. Equivalently, for every process i, for every round 
k > 1, for every m < n and for every (k — l)-round run p we have: 

inf P A [Wi(k) \ AT(k), Tr k _ 1 = p] > A. 

A;P A [\V(k)\=m,ieV(k) \ X(k), n k _ 1= p \ =1 
PA[Ar(k),Tr k - 1=P ]>0 

Proof. This result is a simple consequence of Proposition 3.6.7 whose proof is 

presented next. In that proposition one considers the set of ^-restricted adversaries 

A such that P A [Af(k), Xk-i = p, i & V(k), \V(k)\ = m] > 0. This condition is 

equivalent to the conjunction of the two inequalities P A [Af(k), Xk-i = p] > and 

P A [i e V(k), \V(k)\ = m \ Af(k), 7r fc _i = p] > 0. By Lemma 3.6.5 the set of 

conditions 

A restricted adversary 



Pa 
Pa 



i G V(k), \V(k)\ = in I M{k), vr^ = p] > 
Af(k), 7r fc _! = p] > 
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is equivalent to 

*ieP(k),\P(k)\ = m\Af(k),ir k _ 1 = p 
Af(k), 7r fc _! = p] > 0, 

where no a priori restriction applies here to A. Theorem 3.6.6 is therefore a direct 
consequence of Proposition 3.6.7. □ 

Note that we proved along that if the adversary is m-imposing and renew-knowing 
then the distinction between an i-knowing and an i-imposing adversary disappears. 
More formally 

{A;P A [B 3 \B U B 2 ,B 4 ] = 1} = {A; P A [B 3 ,B 1 \B 2 ,B 4 ] = 1 } , 45 

This shows that the way the precondition B x is formalized is inconsequential for 
m-imposing and renew-knowing adversaries. On the other hand, as we saw already 
several times, the adequate 46 formalization of the precondition B 2 is obtained by 
probabilistic conditioning. This establishes that the measure used in Theorem 3.6.6 
is as adequate 46 as it can be, provided that the adversary is m-imposing and renew- 
knowing. These two restrictions are brought to solve the two problems revealed in 
Theorems 3.6.1 and 3.6.2, respectively. 

Proposition 3.6.7 Let i be a process, k a round number, and p be a (k — l)-round 
run. For concision of notation we let All denote the event schema {Af(k), Xk-i = 
p, i e V(k), \V(k)\ = to}. We have: 

inf P A >\Wi(k) | Af(k), Tiw = p,ie V(k), \V(k)\ = m \>2-. 
p a ,[au]>o L ' J 3m 

Proof. We will make constant use of the notation [n] = {1,2, . . . ,n}. Also, for 
any sequence (a,),GN we will write a, = Umaxa,- to mean that i is the only index in 

J for which a, = Maxa,-. 

j e J J 

We first define the events U{k) and Uj(k), where J is any subset of {1, . . . , n}: 
U{k) = {3li e V{k) s.t. Bi{k) = Max Bj(k)}, 

3 G V(k) 

U'j{k) = {3li e J s.t. fiiik) = Max/3j-(A;)}. 

j € J 



We never used the fact that we were conditioning on B2 so that the same equality holds without 
the mention of B2. As is discussed in page 69, this correspond to analyzing the system at the point 
Sk equal to the beginning of the execution. 

The term adequate is used in the sense defined on page 53. 
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The main result established in [49] can formally be restated as: 

Vm<n, P[ll( m] (k)] >2/3. (3.3) 

Following the general proof technique described in the introduction we will prove 
that : 



P A . [U(k) | AT(k), tt*.! = p,ie V(k), \V(k)\ = m\= P[U'Jk)\ , 
and that: 

Pa> \ Wi(k) | AT(k), tt*.! = p,ie V(k), \V(k)\ = m,U{k) 



= P\fi l (k) = MaxM) U'Jk)\ . 

L 3 6 [m] J 

The events involved in the LHS of the two inequalities (e.g., Wi(k), U(k), {\V(k)\ = 
to}, {iTk-i = p}, {i G V(k)}) depend on A' whereas the events involved in the RHS 
are pure mathematical events over which A' has no control. 

We begin with some important remarks. 

(1) By definition, the set V{k) = {i l7 i 2 , . . .} is decided by the restricted adversary 
A' at the beginning of round k: for a given A' and conditioned on {iTk-i = /°} 5 the 
set V(k) is defined deterministically. In particular, for any i, P A '[ i G P(k) \ 
ir k _ 1 = p]h&s value or 1. Similarly, there is one value m for which P A \ \V{k)\ = 
m | vr fc _! = p] = 1 . Hence, for a given adversary A', if the random event 
{Af(k), 7r fc _! = p, i G V(k), \V(k)\ = m} has non zero probability, it is equal to the 
random event {Af(k), Xk-i = p} — I- 

(2) Recall that, in the modified version of the algorithm that we consider here, a 
process i draws a new lottery value in round k exactly when Ri(k-l) ^ R(k). Hence, 
within /, the event M{ k) is equal to {R il (k- 1) ^ R(k), . . ., R im (k- 1) ^ R(k)}. On 
the other hand, by definition, the random variables (in short r.v.s) /?,.; ij G V{k) 
are iid and independent from the r.v. R(k). This proves that, (for a given A'), 
conditioned on {iTk-i = /°} 5 the r.v. Af{k) is independent from all the r.v.s /?,.. 
Note that U!p, k) {k) is defined in terms of (i.e., measurable with respect to) the 
(Pi^; ij G V(k)), so that U!p, k) {k) and Af{k) are also independent. 

(3) More generally, consider any r.v. X defined in terms of the (/?;.; ij G V{k))\ 
X = f(p il ,...,(3 im ) for some measurable function /. Recall once more that the 
number m and the indices ii,...,i m are determined by {iTk-i = p} an d A'. The 
r.v.s /3j. being iid, for a fixed A', X then depends on {iTk-i = p} only through 
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the value m of \V{k)\. Formally, this means that, conditioned on \V(k)\, the r.v.s 
X and {ir k -i = p} are independent: Ej±\X | x k -i = p ] = Ej±\X | [^(fc)! = 
to] = E[f(Pi,...,(3 m )]. (More precisely, this equality is valid for the value m for 
which P^[ir k _i = p , |P(A;)| = to] ^ 0.) A special consequence of this fact is that 

PAK {k) (k)\ ^-i = p] = P[u{ m] (k)]. 

Remark that, in U(k), the event Wi{k) is the same as the event {Bi(k) = Umax Bj(k)}. 

j e v(k) 

This justifies the first following equality. The subsequent ones are commented after- 
wards. Also, the set / that we consider here is the one having a non zero probability 
described in Remark (1) above. 

PAWi(k)\ u(k),i] 

= PA'[Bi(k) = VmcixBjik) I U(k), I] 

j e v(k) 

= PAfMk) = UmaxM) | K w (k), I, ] (3.4) 

3 G V(k) v ' 

= PAPi(k) = UmaxM) | UL k) (k), tt*.! = p] (3.5) 

3 G V(k) v ' 

Equation 3.4 is true because we condition on Af{k) and because U{k) n Af{k) = 
U!p, k) {k). Equation 3.5 is true because Af{k) is independent from the r.v.s fi ij as is 
shown in Remark (2) above. 

We then notice that the events {(ii{k) = Umax /?• (k)} and U!p, k) {k) (and hence their 

3 6 'P(k) • ' 

intersection) are defined in terms of the r.v.s /?,.. From remark (3) above, the value 
of Eq. 3.5 depends only on m and is therefore independent of i. Hence, for all i and 
j in V{k), PAWi(k) | U(k),I] = PAW s (k) \ U{k), I ]. 

On the other hand, Y.iPT(k) P A>[Pi(k) = Umax /?•(&) I UL k) (k), 7r fc _! = p ] = 1: 
indeed, one of the /3 8 - . has to attain the maximum. 

These last two facts imply that, \/i £ V(k), 

PAWi(k)\ U{k), I] = l/m. 

We now turn to the evaluation of P^i[,U(k) | /]. 

PAW) I I] = PAK( k )(k) | /] (3.6) 

= PAK(A k ) I **-i = p] ( 3 - 7 ) 

= P[U[ ml {k)\ 

> 2/3. (3.8) 

Equation 3.6 is true because we condition on Af{k). Eq. 3.7 is true because U!p, k) {k) 
and Af{k) are independent (See Remark (2) above). The equality of Eq. 3.8 stems 
from Remark (3) above and the inequality from Eq. 3.3. 
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We can now finish the proof of Proposition 3.6.7. 

PAWi(k) | /] 

>PAWi(k),u(k) | /] 

= PAWi(k) | u(k), i] PAu(k) | /] 

> 2/3 to. 

□ 



We discuss here the lessons brought by our results. (1) Conditioning on Af{k) is 
equivalent to force the algorithm to refresh all the variables at each round. By 
doing this, we took care of the undesirable lingering effects of the past, exemplified 
in Theorems 3.6.2 and 3.6.4. (2) It is not true that: 



P A \(i t (k) = Max Mk) U' v{lc) {k), \V(k)\ = m 
= p[fMk)= Max ^(fc) | ^' m] (A;)], 

i.e., that the adversary has no control over the event {(ii{k) = Max /?,•(&)}. (This 

3 6 'P(k) 

was Rabin's statement in [49].) Indeed, the latter probability is equal to 1/ra 
whereas we proved in Theorem 3.6.1 that there is an adversary for which the former 
is when 2 < m < n. 

The crucial remark explaining this apparent paradox is that, implicit in the expres- 
sion Pj([fti{k) = Max fij{k) I . . .], is the fact that the random variables fij{k) (for 

3 6 "P(k) 

j G V{k)) are compared to each other in a specific way decided by A, before one of 
them reveals itself to be the maximum. For instance, in the example constructed 
in the proof of Theorem 3.6.1, when j takes a step, fij{k) is compared only to the 
fli(k); I < j, and the situation is not symmetric among the processes in V(k). 

But, if the adversary is restricted as in our Definition 3.6.2, or if equivalently, proba- 
bilistic conditioning is done on |P(A;)| = m, the symmetry is restored and the strong 
no-lockout property holds. 

Rabin and Kushilevitz used these ideas from our analysis to produce their algo- 
rithm [36]. 

Our Theorems 3.6.1, 3.6.2 and 3.6.4 explored how the adversary can gain and use 
knowledge of the lottery values held by the processes. The next theorem states that 
the adversary is similarly able to derive some knowledge about the round numbers, 
contradicting the claim in [49] that "because the variable R is randomized just 
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before the start of the round, we have with probability 0.99 that i? 8 - ^ R. v Note 
that, expressed in our terms, the previous claim translates into R(k) ^ Ri(k — 1). 
Note also that the next measure is adequate, in the sense defined in page 53. 

Theorem 3.6.8 There exists an adversary A, a round k, a step number t, a run 
p t , compatible with A, having t steps and in which round k is under way such that 

P A [R{k) ^ R,{k - 1) \ ir t = Pt ] < .99 . 

Proof. We will write p t = p'p where p' is a k — 1-round run and p is the run 
fragment corresponding to the A;th round under way. Assume that p' indicates that, 
before round k, processes 1,2,3,4 participated only in round k — 1, and that process 
5 never participated before round k. Furthermore, assume that during round k — 1 
the following pattern happened: A waited for the critical region to become free, 
then allocated one step in turn to processes 2, 1, 1,3,3,4,4; at this point 4 entered 
the critical region. (All this is indicated in p 1 .) Assume also that the partial run 
p into round k indicates that the critical region became free before any competing 
process was given a step, and that the adversary then allocated one step in turn to 
processes 5, 3, 3, and that, after 3 took its last step, the critical section was still free. 
We will establish that, at this point, 

P A [R(k) ^ R,{k -l)\Tr t = p'p}< .99 . 

By assumption A; — 1 is the last (and only) round before round k where processes 
1,2,3 and 4 participated. Hence R x {k - 1) = R 2 (k - 1) = R 3 (k - 1) = R(k - 1). 
To simplify the notations we will let R 1 denote this common value. Similarly we 
will write (3[, /3 2 , ... in place of fii{k — 1), (3 2 (k — 1), . . . We will furthermore write 
/?i, /3 2 , ... in place of fli(k), /3 2 (fc), . . . and B, R in place of B(k), R(k). 

Using Bayes rule gives us: 

P A [R^R'\p', p] = ^^ 'p | ,/' T -■ 3.9 

Pa[p\ P\ 

In the numerator, the first term P A [R ^ R' \ p'] is equal to 0.99 because R is 
uniformly distributed and independent from R' and p'. We will use this fact another 
time while expressing the value of P A [p \ p']: 

Pa[p\p'] 
= P A [p | p\R^R']P A [R^R' | p'} 
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+ P A [p | p',R = R']P A [R = R'\p'] 
= 0.99 P A [p | p',R^R'] (3.10) 

+ 0.01 P A [ P | p',R = R'}. 

• Consider first the case where R ^ R '. Then process 3 gets a YES answer when 
going through the test "(V.R j^ R 3 ) or (V.B < B 3 ) v , and consequently chooses a 
new value B 3 (k) = /3 3 . Hence 

P A [p\ p\R^R'} = P[{3 3 <{3 5 }. (3.11) 

• Consider now the case R = R'. By hypothesis, process 5 never participated in the 
computation before round k and hence draws a new number B 5 (k) = (3 5 . Hence: 

P A [p I p',R = R'] = P A [B 3 (k)<p 5 I p',R = R']. (3.12) 

As processes 1, . . . , 4 participated only in round k — 1 up to round k, the knowledge 
provided by p' about process 3 is exactly that, in round k — 1, process 3 lost to 
process 2 along with process 1, and that process 2 lost in turn to process 4, i.e., that 
P3 < P21 /?i < ^2 an( i ^2 < /?4- For the sake of notational simplicity, for the rest 
of this paragraph we let X denote a random variable whose law is the law of (3' 2 
conditioned on {(3' 2 > Max{(3[, (3' 3 }, (3' 2 < (3' 4 }. This means for instance that, \/x £ R, 

P[X >x} = p[/3' 2 >x\p' 2 > Max{#,&}, fi' 2 < fi' A ] . 

When 3 takes its first step within round k, the program variable V.B holds the value 
/3 5 . As a consequence, 3 chooses a new value when and exactly when B 3 (k — 1)(= (3' 3 ) 
is strictly bigger then /3 5 . (The case (3' 3 = (3 5 would lead 3 to take possession of the 
critical section at its first step in round k, in contradiction with the definition of p; 
and the case (3' 3 < /3 5 leads 3 to keep its "old" lottery value B 3 (k — 1).) From this 
we deduce that: 

P A [B 3 {k)<fc\ p',R = R'] = P[P' 3 </3 5 \ {3' 3 <X} 

+ P[fi' 3 > /3 5 , fi 3 <fh\ P' 3 <X]. (3.13) 

Using Lemma 8.1.5 we derive that: 

p[P' 3 <p 5 \ p' 3 <x]>p[p' 3 <p 5 ]. 

On the other hand P[P' 3 < /3 5 ] = P[P 3 < /3 5 ] because all the random variables 
Pi(j), i = 1, . . . , n, j > 1 are iid. Taking into account the fact that the last term of 
equation 3.13 is non zero, we have then established that: 

P A [B 3 (k)<p 5 \ p',R = R']>P[p 3 <p 5 }. (3.14) 
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Combining Equations 3.11, 3.12 and 3.14 yields: 

P A [p\p',R = R']>P A [p\p', R^R']. 

Equation 3.10 then shows that P A [p | p'\ > Pa[p \ P* -, ^/ R']- Plugging this result 
into Equation 3.9 finishes the proof. □ 

We finish with a result showing that all the problems that we encountered in Rabin's 
algorithm carry over for Ben-Or's algorithm. Ben-Or's algorithm is cited at the end 
of [49]. The code of this algorithm is the same as the one of Rabin with the following 
modifications. All variables B,R,Bi,Rf,l < i < n are boolean variables, initially 
0. The distribution of the lottery numbers is also different but this is irrelevant for 
our discussion. 

We show that Ben-Or's algorithm does not satisfy the weak no-lockout property of 
Definition 3.5.2. The situation is much simpler then in the case of Rabin's algorithm: 
here all the variables are boolean so that a simple reasoning can be worked out. 

Theorem 3.6.9 (Ben-Or's Alg.) There is an adversary A, a step number t and 
a run p t compatible with A such that 



PA[w 2 (k) | ■K t = Pt , 2ev(k)\ =o 



Proof. Assume that we are in the middle of round 3, and that the run p t indicates 
that (at time the critical section was free and then that) the schedule 12 2 3 

3 was followed, that at this point 3 entered in Crit, that it left Crit, that at this 
point the schedule 4 115 5 was followed, that 5 entered and then left Crit, that 6 

4 4 then took a step and that at this point Crit is still free. 

Without loss of generality assume that the round number i?(l) is 0. Then R^i^) = 0, 
-Bi(l) = 1 and -62(1) = 0: if not 2 would have entered in Crit. In round 2 it then 
must be the case that i?(2) = 1. Indeed if this was not the case then 1 would have 
entered the critical section. It must then be the case that -Bi(2) = and B A (2) = 1. 
And then that B 6 (3) = 1 and R(3) = 0: if this was not the case then 4 would have 
entered in Crit in the 3rd round. 

But at this point, 2 has no chance to win if scheduled to take a step! □ 



3.7 Appendix 

This section presents some useful mathematical properties of the truncated expo- 
nential distribution used in [49]. Theorem 3.7.1 and its corollaries are used in the 
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construction of the adversary in Theorem 3.6.2 and Theorem 3.6.4. 
Definition 3.7.1 For any sequence (a^i^ we denote Max s di = Max{cii, a 2 , ■ ■ ., a s }. 
In this section the sequence (/3 8 ) is a sequence of iid geometric random variables: 

P[Pi = i] =^7; 1 = 1,2,... 

The following results are about the distribution of the extremal function Max s /3j. 
The same probabilistic results hold for iid random variables ($), having the trun- 
cated distribution used in [49]: we just need to truncate at log 2 n + 4 the random 
variables /3 8 - and the values that they take. This does not affect the probabilities 
because, by definition, P[/3 8 '(A;) = log 2 n + 4] = J2i>\op n+4^^ 8 ' = ^' ^ e w ^ nee d 
the following function: 

<f>(x) = 1 - e" 2l ~\ (3.15) 

Theorem 3.7.1 For all s £ N and x £ M. such that log 2 s + x £ N and such that 
(sY~ x < 1/2, we have the following approximation: 



A = P[ Max s fii > log 2 s + x ] ~ 1 — e 



-2 1 " 



A bound on the error is given by 



A-(l-e- 



< e 



Proof. We easily see that, Vj £ N, P[Max s /3 8 - < j] = (1 - 2 1_i ) s . Setting 
j = log 2 s + x gives: 



P[Max s /3 8 - < log 2 s + a;] = 1 ~e 



2 l-x 



S 



-2 1 " 



The upper bound on the error term is obtained by writing a precise asymptotic 
expansion of ( 1 — - x J . □ 



The upper bound on the error shows that this approximation is very tight when s is 
big. In the construction of Theorem 3.6.2 we consider the case where where s ~ ra/2 
and x = —1/2 log n. The error term is then less then e~ n . As an illustration of 
the theorem we deduce the two following results. 

Corollary 3.7.2 Consider s > 1. Then P[Max s (3i > [log 2 s\ - 4] > 1 - e" 32 . 
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Proof. Write [log 2 5j = log 2 s - t with < t < 1. Then 



P[ Max,/?,- = Llog 2 sJ - 4 ] > P[ Max s /3 8 - > log 2 s -(4 + t)\ 

2 i + (4+t) 32 

~ 1 — e > 1 — e 



□ 



Corollary 3.7.3 Consider s > 1. T/ien P[ Ma^/3; > [/o# 2 s] + 8] < 0.01 . 

Proof. 1 - e" 21 " 8 ~ 2" 7 < 0.01 . D 

These results express that the maximum of s random variables /3 8 - is concentrated 
tightly around log 2 s: Corollary 3.7.2 shows that the maximum is with overwhelming 
probability at least as big as [k>g 2 sj — 4, whereas Corollary 3.7.3 shows that with 
probability 99% this maximum is at most [~log 2 s] + 7. 

Corollary 3.7.4 Let s > 1. Then p\Max s f3i = \log 2 s\\ > 0.17 . For a > 1 

p\Max s fii = \log 2 s] + a] > -(f>'(a + 2). Hence pIMux,^ = \log 2 s] + a] > 0.005, 
for s > 1 and a = 1, . . . , 5 . 

Proof. Let x £ (0,1) such that log 2 s + x = [log 2 s]. (Recall that the random 
variables /3 8 - are integer valued.) Then P[Max s /3 8 - = log 2 s + x] ~ (f>(x) — (j)(x + 1). 
This is equal to —<f>'(() = log 2 2 e" 21 "^ 1 "^ for some (g(j:,i + 1)C (0,2). We check 
immediately that (f>" is negative on ( — oo, 1) and positive on (1, oo). This allows us 
to write that 

p[Max s /3 8 - = flog 2 s] ] > Min(-0'(O),-0'(2)) > 0.17 . 

The same argument gives also that Ma > 1 P\ Max s /3 8 - = [log 2 s] + a = —(f)' (Q for 
some ( G (a, a + 2). In this interval —(/)'(() > —(f>'(a + 2). Hence Va = 1, . . . , 5, 

p[Max s /3 i= [log 2 s]+a] > -0'(7) ~ log 2 2 e" 2 "^" 7 > 0.005. 

D 



Chapter 4 

Proving Time Bounds for 
Randomized Distributed 
Algorithms 

4.1 Introduction 



This chapter is devoted to the analysis of the timed version of Lehmann-Rabin's 
Dining Philosophers algorithm [37]. We consider the case where, by assumption, 
a participating processes cannot wait more then time 1 before taking a step. The 
scheduling of the processes, i.e., the order under which the various processes take 
steps, is not in the control of the algorithm. According to our general paradigm 
(see Chapter 1) we therefore let Player (2) decide the schedules. We will prove that 
Lehmann-Rabin's algorithm verifies a strong correctness property, i.e., a property 
holding against Player (2) knowing the whole past execution. 

As discussed in page 26 in the section about randomized adversaries, randomization 
does not make the adversary more powerful and is not needed to establish the cor- 
rectness of a given algorithm. (We argued nevertheless that considering randomized 
adversaries was very useful for establishing lower bounds.) We will therefore restrict 
ourselves in this chapter to the case of deterministic adversaries. 

Furthermore, following the discussion of page 31, we consider the model where 
Player (2) controls the passage of time. (We showed in page 31 that we could 
equivalently allocate the time control to Player(l).) 

We can summarize the previous discussion by saying that the admissible adversaries 
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are deterministic, know the past execution and do not let a participating process wait 
more then time 1 for a step. (This does not mean that these properties characterize 
completely the set of admissible adversaries. We will for instance also require that 
admissible adversaries let processes exit from their critical section.) 

We showed in page 33 that the model for randomized computing presented in [54] 
was equivalent to the model presented in Definition 2.3.1 in the case where 1) 
Player(l) knows the complete state of the system and remembers it, and 2), deter- 
ministic adversaries are considered. We therefore can and will equivalently develop 
the analysis of [37] in the model of [54]. 

The original correctness property claimed by Lehmann and Rabin in [37] was that for 
all admissible adversaries, the probability that the execution is deadlocked is equal 
to zero. The authors of [37] did not write a formal transcription of this property. 
In particular they never made explicit what was the event-schema 1 associated to 
the informal description "the execution is deadlocked". (Note that such a property 
involves infinitely many random tosses.) They similarly did not provide a formal 
proof of correctness making explicit the probability spaces {^IaiGaiPa) described 
in our Section 2.4. A more formal proof is therefore needed. 

The introduction of time in the proof of correctness presents three advantages. The 
first one is that it will allow us to work "over a finite horizon of time" instead of the 
whole infinite execution. This represents a major simplification of the setting within 
which the proof is conducted. The second advantage is that the timed results are 
interesting in their own right and provide more insight on the rate at which progress 
occurs during an execution. (The correctness statement presented in [37] states in 
essence that progress eventually occurs with probability one.) Last but not least, to 
establish our result we develop a new general method based on progress functions 
defined on states, for proving upper bounds on time for randomized algorithms. 
Our method consists of proving auxiliary statements of the form U — ► U' , which 

means that whenever the algorithm begins in a state in set U, with probability p, 
it will reach a state in set U' within time t. Of course, this method can only be 
used for randomized algorithms that include timing assumptions. A key theorem 
about our method is the composability of these U — ► U' arrows, as expressed by 

Theorem 4.3.2. This composability result holds even in the case of (many classes 
of) non-oblivious adversaries. 

We also present two complementary proof rules that help in reasoning about sets 
of distinct random choices. Independence arguments about such choices are often 
crucial to correctness proofs, yet there are subtle ways in which a non-oblivious ad- 



see page 43 for a definition of an event-schema 
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versary can introduce dependencies. For example, a non-oblivious adversary has the 
power to use the outcome of one random choice to decide whether to schedule an- 
other random choice. Our proof rules help to systematize certain kinds of reasoning 
about independence. 

As mentioned above, we present our proof in the context of the general framework 
[54] for describing and reasoning about randomized algorithms. This framework in- 
tegrates randomness and nondeterminism into one model, and permits the modeling 
of timed as well as untimed systems. The model of [54] is, in turn, based on existing 
models for untimed and timed distributed systems [30, 41], and adopts many ideas 
from the probabilistic models of [58, 27]. 

13 

Using this general method we are able to prove that T — > C, where T is the set 

1/8 

of states in which some process is in its trying region, while C is the set of states in 
which some process is in its critical region. That is, whenever the algorithm is in 
a state in which some process is in the trying region, with probability 1/8, within 
time 13, it will reach a state in which some process is in its critical region. This 
bound depends on the timing assumption that processes never wait more then time 
1 between steps. A consequence of this claim is an upper bound (of 63) on the 
expected time for some process to reach its critical region. 

For comparison, we already mentioned that [37] contains only proof sketches of 
the results claimed. The paper [62] contains a proof that Lehmann and Rabin's 
algorithm satisfies an eventual progress condition, in the presence of an adversary 
with complete knowledge of the past; this proof is carried out as an instance of Zuck 
and Pnueli's general method for proving liveness properties. Our results about this 
protocol can be regarded as a refinement of the results of Zuck and Pnueli, in that 
we obtain explicit constant time bounds rather than liveness properties. 

The rest of the paper is organized as follows. Section 4.2 presents a simplified version 
of the model of [54]. Section 4.3 presents our main proof technique based on time- 
bound statements. Section 4.4 presents the additional proof rules for independence 
of distinct probabilistic choices. Section 4.5 presents the Lehmann- Rabin algorithm. 
Section 4.6.2 formalizes the algorithm in terms of the model of Section 4.2, and gives 
an overview of our time bound proof. Section 4.7 contains the details of the time 
bound proof. 

Acknowledgments. Sections 4.2, 4.3 and 4.4 were written by Roberto Segala. 
The references in the subsequent proofs to execution automata, and to the event 
schemas Unit-Time, FlRST(a,U) and NEXT(a, U) are also his contribution. (The 

notation U — ► U' and Theorem 4.3.2 is part of the work of the author.) 

p 
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4.2 The Model 

In this section, we present the model that is used to formulate our proof technique. 
It is a simplified version of the probabilistic automaton model of [54]. As mentioned 
in page 33, this model considers the case where 1) Player(l) knows and remembers 
the complete state of the system, and 2), deterministic adversaries are considered. 
Under these conditions it is equivalent to the model presented in Chapter 2. Here 
we only give the parts of the model that we need to describe our proof method and 
its application to the Lehmann- Rabin algorithm; we refer the reader to [54] for more 
details. 

Definition 4.2.1 A probabilistic automaton 2 M consists of four components: 

• a set states(M) of states 

• a nonempty set start(M) C states(M) of start states 

• an action signature sig(M) = (ext(M), int(M)) where ext(M) and int(M) are 
disjoint sets of external and internal actions, respectively 

• a transition relation steps(M) C states(M)xacts(M)xProbs(states(states(M))), 
where the set Probs(states(states(M))) is the set of probability spaces (0, J 7 , P) 
such that S7 C states(M) and T = 2°. The last requirement is needed for tech- 
nical convenience. 

A probabilistic automaton is fully probabilistic if it has a unique start state and from 
each state there is at most one step enabled. 

Thus, a probabilistic automaton is a state machine with a labeled transition relation 
such that the state reached during a step is determined by some probability distri- 
bution. For example, the process of flipping a coin is represented by a step labeled 
with an action flip where the next state contains the outcome of the coin flip and 
is determined by a probability distribution over the two possible outcomes. A prob- 
abilistic automaton also allows nondeterministic choices over steps. An example of 
nondeterminism is the choice of which process takes the next step in a multi-process 
system. 

An execution fragment a of a probabilistic automaton M is a (finite or infinite) 
sequence of alternating states and actions starting with a state and, if the execution 



In [54] the probabilistic automata of this definition are called simple probabilistic automata. 
This is because that paper also includes the case of randomized adversaries. 
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fragment is finite, ending in a state, a = s ais 1 a 2 s 2 • • •, where for each i there exists 
a probability space (0,.F, P) such that (s,, a i+ i, (O,^ 7 , P)) G steps(M) and s J+1 G fi. 
Denote by fstate(a) the first state of a and, if a is finite, denote by Istate(a) the 
last state of a. Furthermore, denote by frag*(M) and frag(M) the sets of finite and 
all execution fragments of M, respectively. An execution is an execution fragment 
whose first state is a start state. Denote by exec*(M) and exec(M) the sets of finite 
and all executions of M , respectively. A state s of M is reachable if there exists 
a finite execution of M that ends in s. Denote by rstates(M) the set of reachable 
states of M. 

A finite execution fragment o^ = So a i s i • • ~ a n s n of M and an execution fragment 
a 2 = s n a n+ is n+ i ■ ■ ■ of M can be concatenated . In this case the concatenation, 
written o^ • a 2 , is the execution fragment s aiS! • • •a n s n a n+1 s n _|_ 1 • • •. An execution 
fragment o^ of M is a prefix of an execution fragment a 2 of M, written «i < a 2 , if 
either o^ = a 2 or o^ is finite and there exists an execution fragment a[ of M such 
that a 2 = ai ■ a[. 

In order to study the probabilistic behavior of a probabilistic automaton, some 
mechanism to remove nondeterminism is necessary. To give an idea of why the 
nondeterministic behavior should be removed, consider a probabilistic automaton 
with three states s ,Si,s 2 and with two steps enabled from its start state s ; the 
first step moves to state Si with probability 1/2 and to s 2 with probability 1/2; 
the second step moves to state Si with probability 1/3 and to s 2 with probability 
2/3. What is the probability of reaching state Si? The answer depends on how 
the nondeterminism between the two steps is resolved. If the first step is chosen, 
then the probability of reaching state Si is 1/2; if the second step is chosen, then 
the probability of reaching state Si is 1/3. We call the mechanism that removes 
the nondeterminism an adversary, because it is often viewed as trying to thwart the 
efforts of a system to reach its goals. In distributed systems the adversary is often 
called the scheduler, because its main job may be to decide which process should 
take the next step. 

Definition 4.2.2 An adversary for a probabilistic automaton M is a function A 
taking a finite execution fragment of M and giving back either nothing (represented 
as 8) or one of the enabled steps of M if there are any. Denote the set of adversaries 
for M by Advs M 3 . 

Once an adversary is chosen, a probabilistic automaton can run under the control 
of the chosen adversary. The result of the interaction is called an execution automa- 



In [54] the adversaries of this definition are denoted by DAdvsM, where D stands for Determin- 
istic. The adversaries of [54] are allowed to use randomness. 
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ton. The definition of an execution automaton, given below, is rather complicated 
because an execution automaton must contain all the information about the differ- 
ent choices of the adversary, and thus the states of an execution automaton must 
contain the complete history of a probabilistic automaton. Note that there are no 
nondeterministic choices left in an execution automaton. 

Definition 4.2.3 An execution automaton H of a probabilistic automaton M is a 
fully probabilistic automaton such that 

1. states(H) Cfrag*(M). 

2. for each step (a, a, (0, J 7 , P)) of H there is a step (Istate(a), a, (0', J 7 ', P')) of 
M, called the corresponding step, such that = {aas|s £ 0'} and P'[aas] = 
P[s] for each s£fl'. 

3. each state of H is reachable, i.e., for each a £ states(H) there exists an 
execution of H leading to state a. 

Definition 4.2.4 Given a probabilistic automaton M, an adversary A £ Advs M , 
and an execution fragment a £ frag*(M), the execution H(M,A,a) of M under 
adversary A with starting fragment a is the execution automaton of M whose start 
state is a and such that for each step (a',a,(Q,,J-,P)) £ steps(H(M,A,ot)), its 
corresponding step is the step A(a'). 

Given an execution automaton H , an event is expressed by means of a set of maximal 
executions of H , where a maximal execution of H is either infinite, or it is finite 
and its last state does not enable any step in H . For example, the event "eventually 
action a occurs" is the set of maximal executions of H where action a does occur. 
A more formal definition follows. The sample space £l H is the set of maximal 
executions of H . The u-algebra Th is the smallest u-algebra that contains the set 
of rectangles R a , consisting of the executions of £l H having a as a prefix 4 . The 
probability measure P H is the unique extension of the probability measure defined 
on rectangles as follows: Pn[R a ] is the product of the probabilities of each step of H 
generating a. In [54] it is shown that there is a unique probability measure having 
the property above, and thus (£l H ,J 7 H ,P H ) is a well defined probability space. For 
the rest of this abstract we do not need to refer to this formal definition any more. 

Events of Th are not sufficient for the analysis of a probabilistic automaton. Events 
are defined over execution automata, but a probabilistic automaton may generate 



Note that a rectangle R a can be used to express the fact that the finite execution a occurs. 
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several execution automata depending on the adversary it interacts with. Thus a 
more general notion of event is needed that can deal with all execution automata. 
Specific examples are given in Section 4.3. 

Definition 4.2.5 An event schema e for a probabilistic automaton M is a function 
associating an event of Th with each execution automaton H of M. 

We now discuss briefly a simple way to handle time within probabilistic automata. 
The idea is to add a time component to the states of a probabilistic automaton, 
to assume that the time at a start state is 0, to add a special non-visible action 
v modeling the passage of time, and to add arbitrary time passage steps to each 
state. A time passage step should be non-probabilistic and should change only the 
time component of a state. This construction is called the patient construction in 
[44, 57, 22]. The reader interested in a more general extension to timed models is 
referred to [54]. 

We close this section with one final definition. Our time bound property for the 
Lehmann-Rabin algorithm states that if some process is in its trying region, then 
no matter how the steps of the system are scheduled, some process enters its critical 
region within time t with probability at least p. However, this claim can only be 
valid if each process has sufficiently frequent chances to perform a step of its local 
program. Thus, we need a way to restrict the set of adversaries for a probabilistic 
automaton. The following definition provides a general way of doing this. 

Notation. We let Advs denote a subset of Advs M . 



4.3 The Proof Method 

In this section, we introduce our key statement U — >Advs U' and the composability 
theorem, which is our main theorem about the proof method. 

The meaning of the statement U — >Advs U' is that, starting from any state of U 

and under any adversary A of Advs, the probability of reaching a state of U' within 
time t is at least p. The suffix Advs is omitted whenever we think it is clear from 
the context. 

Definition 4.3.1 Let eu>,t be the event schema that, applied to an execution au- 
tomaton H , returns the set of maximal executions a of H where a state from U' is 

reached in some state of a within time t. Then U — >Advs U' iff for each s G U and 

p 

each A E Advs, P H (M,A,s)[eu' ,t(H (M , A, s))] > p. 
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Proposition 4.3.1 Let U, U', U" be sets of states of a probabilistic automaton M. 

If U -U U', then U U U" -U U' U U" . 
J p ' p 

In order to compose time bound statements, we need a restriction for adversary 
schemas stating that the power of the adversary schema is not reduced if a prefix of 
the past history of the execution is not known. Most adversary schemas that appear 
in the literature satisfy this restriction. 

Definition 4.3.2 An adversary schema Advs for a probabilistic automaton M is 
execution closed if, for each A G Advs and each finite execution fragment a G 
frag*(M), there exists an adversary A' G Advs such that for each execution fragment 
a' G frag*(M) with Istate(a) = fstate(a'), A'(a') = A(a ■ a'). 

Theorem 4.3.2 Let Advs be an execution closed adversary schema for a probabilis- 
tic timed automaton M , and let U, U', U" be sets of states of M . 

If U -^Advs U' and U' -^ A dvs U" , then U ^ A dvs U". 

Pl P2 PlP2 

Sketch of proof: Consider an adversary A G Advs that acts on M starting from 
a state s of U. The execution automaton H(M,A,s) contains executions where a 
state from U' is reached within time ti. Consider one of those executions a and 
consider the part H of H(M,A,s) after the first occurrence of a state from U' in 
a. The key idea of the proof is to use execution closure of Advs to show that there 
is an adversary that generates H , to use U' —^Advs U" to show that in if a state 

from U" is reached within time t 2 with probability at least p 2 , and to integrate 
this last result in the computation of the probability of reaching a state from U" in 
H(M, A, s) within time t x + t 2 . ■ 



4.4 Independence 

Example 4.4.1 Consider any distributed algorithm where each process is allowed 
to flip fair coins. It is common to say "If the next coin flip of process P yields head 
and the next coin flip of process Q yields tail, then some good property (f> holds." 
Can we conclude that the probability for (f> to hold is 1/4? That is, can we assume 
that the coin flips of processes P and Q are independent? The two coin flips are 
indeed independent of each other, but the presence of non-oblivious adversaries may 
introduce some dependence. An adversary can schedule process P to flip its coin 
and then schedule process Q only if the coin flip of process P yielded head. As a 
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result, if both P and Q flip a coin, the probability that P yields head and Q yields 
tail is 1/2. 

Thus, it is necessary to be extremely careful about independence assumptions. It 
is also important to pay attention to potential ambiguities of informal arguments. 
For example, does (f> hold if process P flips a coin yielding head and process Q does 
not flip any coin? Certainly such an ambiguity can be avoided by expressing each 
event in a formal model. 

In this section we present two event schemas that play a key role in the detailed 
time bound proof for the Lehmann-Rabin algorithm, and we show some partial 
independence properties for them. The first event schema is a generalization of 
the informal statement of Example 4.4.1, where a coin flip is replaced by a generic 
action a, and where it is assumed that an event contains all the executions where 
a is not scheduled; the second event schema is used to analyze the outcome of the 
first random draw that occurs among a fixed set of random draws. A consequence 
of the partial independence results that we show below is that under any adversary 
the property (f> of Example 4.4.1 holds with probability at least 1/4. 

Let (a, U) be a pair consisting of an action of M and a set of states of M. The 
event schema FlRST(a, U) is the function that, given an execution automaton H , 
returns the set of maximal executions of H where either action a does not occur, or 
action a occurs and the state reached after the first occurrence of a is a state of U . 
This event schema is used to express properties like "the i th coin yields left". For 
example a can be flip and U can be the set of states of M where the result of the 
coin flip is left. 

Let (a l5 Ui), . . ., (a n , U n ) be a sequence of pairs consisting of an action of M and a 
set of states of M such that for each i,j, 1 < i < j ' < n, a, j^ a,j. Define the event 
schema NEXT((a l7 Ui), . . ., (a„, U n )) to be the function that applied to an execution 
automaton H gives the set of maximal executions of H where either no action from 
{a l7 . . . , a n } occurs, or at least one action from {a l5 . . . , a n } occurs and, if a, is the 
first action that occurs, the state reached after the first occurrence of a, is in Ui. 
This kind of event schema is used to express properties like "the first coin that is 
flipped yields left." 

Proposition 4.4.2 Let H be an execution automaton of a probabilistic automaton 

M . Furthermore, let (ai , Ui), . . . , (a„, U n ) be pairs consisting of an action of M and 
a set of states of M such that for each i,j, 1 < i < j < n, ai ^ a,j. Finally, let 
Pi, . . . ,p n be real numbers between and 1 such that for each i, 1 < i < n, and each 
step (s,a,(Cl,J-,P)) G steps(M) with a = a i} the probability P[Ui P\ 0] is greater 
than or equal to p i} i.e., P[Ui P\ 0] > Pi. Then 
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1. Pff[(FIRST(ai, Uij n • • • n FlRST(a n , U n )){H)} > pi • • -p n , 

2. P H [NEXT((ai,f7i),...,(a„,f7„))(5')] > mm(pi,...,p n ). 

4.5 The Lehmann-Rabin Algorithm 

The Lehmann-Rabin algorithm is a randomized algorithm for the Dining Philoso- 
phers problem. This problem involves the allocation of n resources among n com- 
peting processes arranged in a ring. The resources are considered to be interspersed 
between the processes, and each process requires both its adjacent resources in or- 
der to reach its critical section. All processes are identical; the algorithm breaks 
symmetry by using randomization. The algorithm ensures the required exclusive 
possession of resources, and also ensures that, with probability 1, some process is 
always permitted to make progress into its critical region. 

Figure 4.1 shows the code for a generic process i. The n resources are represented by 
n shared variables Res l7 . . . , Res n , each of which can assume values in {free, taken}. 
Each process i ignores its own name, i, and the names, Res 8 -_i and Res,, of its 
adjacent resources. However, each process i is able to refer to its adjacent resources 
by relative names: Res^ieft) is the resource located to the left (clockwise), and 
R es (i, right) is the resource to the right (counterclockwise) of i. Each process has a 
private variable m,, which can assume a value in {left, right}, and is used to keep 
track of the first resource to be handled. For notational convenience we define an 
operator opp that complements the value of its argument, i.e., opp(right) = left 
and opp(left) = right. 

The atomic actions of the code are individual resource accesses, and they are rep- 
resented in the form < atomic- action> in Figure 4.1. We assume that at most one 
process has access to the shared resource at each time. 

An informal description of the procedure is "choose a side randomly in each iteration. 
Wait for the resource on the chosen side, and, after getting it, just check once for 
the second resource. If this check succeeds, then proceed to the critical region. 
Otherwise, put down the first resource and try again with a new random choice." 

Each process exchanges messages with an external user. In its idle state, a process 
is in its remainder region R. When triggered by a try message from the user, it 
enters the competition to get its resources: we say that it enters its trying region T. 
When the resources are obtained, it sends a crit message informing the user of the 
possession of these resources: we then say that the process is in its critical region 
C . When triggered by an exit message from the user, it begins relinquishing its 
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Shared variables: ReSj £ {free, taken}, j ■■ 
Local variables: m, G {left, right}, i = 1, 
Code for process i: 



1, . . . , ra, initially free. 

.,n 



0. 

1. 

2. 



3. 



4. 
5. 

6. 

7. 

8. 
9. 



try 

< Ui 



** beginning of Trying Section ** 
random> ** choose left or right with equal probability ** 



< if ReS(-j „.-) = free then 



Res 



0>,) 



taken 



else goto 2. > 
< if Res 



(i,opp(u,)) 



Res 



(i,opp(u,)) 



free then 
= taken; 



goto 5. > 

< Res(j )tli ) := free; goto l.> 
crit 

** Critical Section ** 
exit 

< Ui <— left or right 
Res(i i0pp ( tli )) := free > 

< Res( i)tli ) := free > 
rem 

** Remainder Section ** 



** 



pick up first resource 



** 



pick up second resource 



** 



** 



** put down first resource ** 
** end of Trying Section ** 

** beginning of Exit Section ** 

** nondeterministic choice ** 

** put down first resources ** 

** put down second resources ** 

** end of Exit Section ** 



Figure 4.1: The Lehmann- Rabin algorithm 



resources: we then say that the process is in its exit region E. When the resources 
are relinquished its sends a rem message to the user and enters its remainder region. 



4.6 Overview of the Proof 



In this section, we give our high-level overview of the proof. We first introduce 
some notation, then sketch the proof strategy at a high level. The detailed proof is 
presented in Section 4.7. 
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4.6.1 Notation 

In this section we define a probabilistic automaton M which describes the system 
of Section 4.5. We assume that process i + 1 is on the right of process i and that 
resource Res, is between processes i and i + 1. We also identify labels modulo n so 
that, for instance, process n + 1 coincides with process 1. 

A state s of M is a tuple (X l7 . . . , X n , Res l7 . . . , Res n , t) containing the local state X,- 
of each process i, the value of each resource Res,, and the current time t. Each local 
state Xi is a pair (pc,-, w,-) consisting of a program counter pc i and the local variable 
Mj. The program counter of each process keeps track of the current instruction in 
the code of Figure 4.1. Rather then representing the value of the program counter 
with a number, we use a more suggestive notation which is explained in the table 
below. Also, the execution of each instruction is represented by an action. Only 
actions try,., crit,', rem;, exit, below are external actions. 

Number pc i Action name Informal meaning 

R try;- Remainder region 

1 F flip,. Ready to Flip 

2 W wait. Waiting for first resource 

3 S second. Checking for Second resource 



PCi 


Action name 


R 


tr Yi 


F 


flip, 


W 


wait,- 


s 


second,- 


D 


drop,. 


P 


crit,' 


C 


exit,- 


E F 


dropf,. 


E s 


drops,. 


E R 


rem; 



4 D drop,. Dropping first resource 

5 P crit,- Pre-critical region 

6 C exit,- Critical region 

7 E F dropf,. Exit 

8 E s drops,. Exit 

9 En rem,- Exit 



drop First resource 
drop Second resource 
move to Remainder region 



The start state of M assigns the value free to all the shared variables Res,-, the 
value R to each program counter pc,-, and an arbitrary value to each variable m,-. 
The transition relation of M is derived directly from Figure 4.1. For example, for 
each state where pc i = F there is an internal step flip,- that changes pc i into W 
and assigns left to m,- with probability 1/2 and right to m,- with probability 1/2; 
from each state where X,- = (W, left) there is a step wait,- that does not change 
the state if Res(,'i e f t ) = taken, and changes pc i into S and Res(,'i e f t ) into taken if 
R es (i,ieft) = free; for each state where pc i = E F there are two steps with action 
dropf,-: one step sets m,- to right and makes Res(,'i e f t ) free, and the other step 
sets Ui to left makes Res(,' r i ght ) free. The two separate steps correspond to a 
nondeterministic choice that is left to the adversary. For time passage steps we 
assume that at any point an arbitrary amount of time can pass; thus, from each 
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state of M and each positive 8 there is a time passage step that increases the time 
component of 8 and does not affect the rest of the state. 

The value of each pair X 8 - can be represented concisely by the value of pc i and an 
arrow (to the left or to the right) which describes the value of m,. Thus, informally, 
a process i is in state S or D (resp. S or D) when i is in state S or D while 
holding its right (resp. left) resource; process i is in state W (resp. W) when i 
is waiting for its right (resp. left) resource to become free; process i is in state 
E s (resp. E s ) when i is in its exit region and it is still holding its right (resp. 
left) resource. Sometimes we are interested in sets of pairs; for example, whenever 
pc i = F the value of m, is irrelevant. With the simple value of pc i we denote the set 
of the two pairs {(pc 8 -, left), (pc 8 -, right)}. Finally, with the symbol # we denote 
any pair where pc i £ {W, S, D}. The arrow notation is used as before. 

For each state s = (X , ■ ■ . ,X„_i, Res l7 . . . , Res„_i,i) of M we denote by Xj(s) the 
pair Xi and by ReSj(s) the value of the shared variable Res, in state s. Also, for any 
set S of states of a process i, we denote by X 8 - £ S , or alternatively X 8 - = S the set of 
states s of M such that X(s) £ S . Sometimes we abuse notation in the sense that 
we write expressions like X, £ {F,D} with the meaning X, £ F U D. Finally, we 
write Xi = E for X { = {E F , E s , E R }, and we write X { = F for X { £ {F, W,S,D,P}. 

A first basic lemma states that a reachable state of M is uniquely determined by 
the local states its processes and the current time. Based on this lemma, our further 
specifications of state sets will not refer to the shared variables; however, we consider 
only reachable states for the analysis. The proof of the lemma is a standard proof 
of invariants. 

Lemma 4.6.1 For each reachable state s of M and each i, 1 < i < n, Resi = taken 
iff Xi(s) £ {S^,D,P,C,E F ,Es} or X i+1 (s) £ {S_,D,P,C,E F ,Es}. Moreover, 
for each reachable state s of M and each i, 1 < i < n, it is not the case that 
Xi(s) £ {S^,D,P,C,E F ,Es} and X i+l (s) £ {S_,D,P,C,E F ,Es}, i.e., only one 
process at a time can hold one resource. □ 

4.6.2 Proof Sketch 

In this section we show that the RL-algorithm guarantees time bounded progress, 
i.e., that from every state where some process is in its trying region, some process 
subsequently enters its critical region within an expected constant time bound. We 
assume that each process that is ready to perform a step does so within time 1: 
process i is ready to perform a step whenever it enables an action different from 
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try j- or exit,. Actions try 8 - and exit, are supposed to be under the control of the 
user, and hence, by assumption, under the control of the adversary. 

Formally, consider the probabilistic timed automaton M of Section 4.6.1. Define 
Unit- Time to be the set of adversaries A for M having the properties that, for 
every finite execution fragment a of M and every execution a' of H(M,A,ot), 1) 
the time in a' is not bounded and 2) for every process i and every state of a' 
enabling an action of process i different from try 8 - and exit,, there exists a step in 
a' involving process i within time 1. Then Unit-Timeis execution-closed according 
to Definition 4.3.2. An informal justification of this fact is that the constraint that 
each ready process is scheduled within time 1 knowing that a ■ a' has occurred only 
reinforces the constraint that each ready process is scheduled within time 1 knowing 
that a' has occurred. Let 

T = {s G rstates(M) | 3,-X,-(s) G {T}} 

denote the sets of reachable states of M where some process is in its trying region, 
and let 

C = {s G rstates(M) | 3,-X,-(s) = C} 

denote the sets of reachable states of M where some process is in its critical region. 
We show that 

T ——^Unit-Time C, 

1/8 

i.e., that, starting from any reachable state where some process is in its trying 
region, for all the adversaries of Unit-Time, with probability at least 1/8, some 
process enters its critical region within time 13. Note that this property is trivially 
satisfied if some process is initially in its critical region. 

Our proof is divided into several phases, each one concerned with the property of 
making a partial time bounded progress toward a "success state", i.e., a state of 
C. The sets of states associated with the different phases are expressed in terms of 
T, 1ZT, T, G,V, and C. Here, 

UT = {s e T | V,-X,-(s) G {E R ,R,T}} 

is the set of states where at least one process is in its trying region and where no 
process is in its critical region or holds resources while being in its exit region. 

T = {seKT\ 3iXi(s) = T} 

is the set of states of 1ZT where some process is ready to flip a coin. 

V = {s G rstates(M) \ 3,-X,-(s) = P} 
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is the sets of reachable states of M where some process is in its pre-critical region. 
The set Q is the most important for the analysis. It parallels the set of "Good 
Pairs"in [62] or the set described in Lemma 4 of [37]. To motivate the definition, we 
define the following notions. We say that a process i is committed if X, £ {W, S}, 
and that a process i potentially controls Res, (resp. Res;_i) if X, £ {W, S , D} 
(resp. Xi £ {W, S , D}). Informally said, a state in 1ZT is in Q if and only if 
there is a committed process whose second resource is not potentially controlled by 
another process. Such a process is called a good process. Formally, 

G = {seTZT\ 3,- Xi(s) £ {W,S_} and X i+1 (s) £ {E R ,R,F,#}, or 
Xi(s) £ {§,5} and X^s) £ {E R ,R,F,f}} 

Reaching a state of G is a substantial progress toward reaching a state of C. Actually, 
the proof of Proposition 4.7.11 establishes that, if i a is good process, then, with 
probability 1/4, one of the three processes i — 1, i and i + 1 soon succeeds in getting 
its two resources. The hard part is to establish that, with constant probability, 
within a constant time, G is reached from any state in T. A close inspection of the 
proof given in [62] shows that, there, the timed version of the techniques used is 
unable to deliver this result. The phases of our proof are formally described below. 

T --> UT U C (Proposition 4.7.3), 

TIT --+ T U V (Proposition 4.7.15), 

T-->GUV (Proposition 4.7.14), 

G --> V (Proposition 4.7.11), 

1/4 v ' 

V --> C (Proposition 4.7.1). 

The first statement states that, within time 2, every process in its exit region re- 
linquishes its resources. By combining the statements above by means of Proposi- 
tion 4.3.1 and Theorem 4.3.2 we obtain 

T -^ C, 

1/8 ' 

which is the property that was to be proven. Using the results of the proof summary 
above, we can furthermore derive a constant upper bound on the expected time 
required to reach a state of C when departing from a state of T. Note that, departing 
from a state in 1ZT, with probability at least 1/8, V is reached in time (at most) 10; 
with probability at most 1/2, time 5 is spent before failing to reach (/UP ("failure 
at the third arrow"); with probability at most 7/8, time 10 is spent before failing 
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to reach V ("failure at the fourth arrow"). If failure occurs, then the state is back 
into 1ZT. Let V denote a random variable satisfying the following induction 

V = 1/8 • 10 + 1/2 (5 + V 1 ) + 3/8 (10 + V 2 ) , 

where Vi and V 2 are random variables having the same distribution as V. The 
previous discussion shows that the expected time spent from 1ZT to V is at most 
-E?[V]. By taking expectation in the previous equation, and using that E[V] = 
E[Vi] = E[V 2 ], we obtain that E[V] = 60 is an upper bound on the expected time 
spent from 1ZT to V, and that, consequently, the expected time for progress starting 
from a state of T is at most 63. 



4.7 The Detailed Proof 

We prove in this section the five relations used in Section 4.6.2. However, for the sake 
of clarity, we do not prove the relations in the order they were presented. Through- 
out the proof we abuse notation by writing events of the kind FlRST(f lip,, left) 
meaning the event schema FlRST(f lip,, {s £ states(M) | X 8 (s) = W}). 

Proposition 4.7.1 If some process is in P, then, within time 1, it enters C, i.e., 

i 

Proof. This step corresponds to the action crit: within time 1, process i informs 
the user that the critical region is free. □ 

Lemma 4.7.2 If some process is in its Exit region then, within time 3, it will enter 
R. 

Proof. The process needs to take first two steps to relinquish its two resources, 
and then one step to send a rem message to the user. □ 

Proposition 4.7.3 T --> UTuC. 

Proof. From Lemma 4.7.2 within time 2 every process that begins in E F or E s 
relinquishes its resources. If no process begins in C or enters C in the meantime, 
then the state reached at this point is a state of TZT; otherwise, the starting state 
or the state reached when the first process enters C is a state of C. □ 
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We now turn to the proof of Q — ► V . The following lemmas form a detailed cases 

1/4 ° 

analysis of the different situations that can arise in states of Q . Informally, each 
lemma shows that some event of the form of Proposition 4.4.2 is a sub-event of the 
properties of reaching some other state. 

Lemma 4.7.4 

1. Assume that X t _i G {E R , R, F} and X t = W. 7f FlRST(flip i _ 1 ,left), then, 
within time 1, either X 8 -_i = P or X, = S . 

2. Assume that X i _ 1 = D and Xi = W. 7f FlRST(flip i _ 1 ,left), then, within 
time 2, either X 8 -_i = P or X, = S . 

3. Assume that X i _ 1 = S and Xi = W. 7f FlRST(flip i _ 1 ,left), then, within 
time 3, either X 8 -_i = P or X, = S . 

4- Assume that X i _ 1 = W and Xi = W. 7f FlRST(flip i _ 1 ,left), then, within 
time 4, either X 8 -_i = P or Xi = S . 

Proof. The four proofs start in the same way. Let s be a state of M satisfying the 
respective properties of items 1 or 2 or 3 or 4- Let A be an adversary of Unit-Time, 
and let a be the execution of M that corresponds to an execution of H(M,A, {s}) 
where the result of the first coin flip of process i — 1 is left. 

1. By hypothesis, i — 1 does not hold any resource at the beginning of a and 
has to obtain Res 8 '_ 2 (its left resource) before pursuing Res;_i. Within time 
1, i takes a step in a. If i — 1 does not hold Res 8 -_i when i takes this step, 
then i progresses into configuration S . If not, it must be the case that i — 1 
succeeded in getting it in the meanwhile. But, in this case, Res 8 -_i was the 
second resource needed by i — 1 and i — 1 therefore entered P. 

2. If Xi = S within time 1, then we are done. Otherwise, after one unit of time, 
Xi is still equal to W, i.e., X(V) = W for all states s' reached in time 1. 
However, process i — 1 takes also a step within time 1. Let a = a x ■ a 2 such 
that the last action of a x corresponds to the first step taken by process i — 1. 
Then Xi_i(fstate(a2)) = F and Xiifstateia^)) = W. Since process i — 1 did 
not flip any coin during o^, from the execution closure of Unit-Time and item 
1 we conclude. 
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3. If Xi = S within time 1, then we are done. Otherwise, after one unit of time, 
Xi is still equal to W, i.e., Xi(s') = W for all states s' reached in time 1. 
However, also process i — 1 takes a step within time 1. Let a = a x ■ a 2 such 
that the last action of a x corresponds to the first step taken by process i — 1. 
If Xi_i(fstate(at2)) = P then we are also done. Otherwise it must be the case 
that Xi_i(fstate(at2)) = D and Xiifstateia^)) = W. Since process i — 1 did 
not flip any coin during o^, from the execution closure of Unit-Time and item 
2 we conclude. 

4. If Xi = S within time 1, then we are done. Otherwise, after one unit of 
time, Xi is still equal to W, i.e., Xi(s') = W for all states s' reached in time 
1. However, since within time 1 process i checks its left resource and fails, 
process i — 1 gets its right resource within time 1, and hence reaches at least 
state S. Let a = a x ■ a 2 where the last step of a x is the first step of a leading 
process i — 1 to state S . Then Xi_i(fstate(at2)) = S and Xiifstateia^)) = W. 
Since process i — 1 did not flip any coin during o^, from the execution closure 
of Unit-Time and item 3 we conclude. □ 

Lemma 4.7.5 Assume that X,_i G {E R ,R,T} and Xi = W. //FlRST(flip i _ 1 ,left) 
then, within time 4, either X 8 -_i = P or Xi = S . 

Proof. The lemma follows immediately from Lemma 4.7.4 after observing that 
*,--i e {Er, R, T} means X % _ x G {E R , R, F,W,S,D,P}. □ 

The next lemma is a useful tool for the proofs of Lemmas 4.7.7, 4.7.8, and 4.7.9. 

Lemma 4.7.6 Assume that Xi G {W, S} or Xi G {E R ,R,F,D} with FlRST(f lip^, 
left), and assume that X i+1 G {W, S} or X i+1 G {E R ,R,F,D} with FlRST(f lip i+1 , 
right). Then the first of the two processes i ori + 1 testing its second resource enters 
P after having performed this test (if this time ever comes). 

Proof. By Lemma 4.6.1 Res, is free. Moreover, Res, is the second resource needed 
by both i and i + 1. Whichever tests for it first gets it and enters P. □ 

Lemma 4.7.7 If Xi = S and X i+ i G {W, S} then, within time 1, one of the two 
processes i or i + 1 enters P. The same result holds if Xi G {W, S } and X i+ i = S . 

Proof. Being in state S, process i tests its second resource within time 1. An 
application of Lemma 4.7.6 finishes the proof. □ 
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Lemma 4.7.8 Assume that X t = S and X i+1 G {E R ,R,F,D}. If FlRST(f lip i+1 , 
right), then, within time 1, one of the two processes i or i + 1 enters P. The same 
result holds if X t G {E R ,R,F,D}, X i+1 = S and FlRST(f lip,-, left). 

Proof. Being in state S, process i tests its second resource within time 1. An 
application of Lemma 4.7.6 finishes the proof. □ 

Lemma 4.7.9 Assume thatX { _ x G {E R ,R,T}, X { = W, and X i+1 G {E R ,R,F,W, 
D}. //FlRST(flip i _ 1 ,left) and FlRST(f lip i+1 , right), then within time 5 one of 
the three processes i — 1, i or i + 1 enters P. 

Proof. Let s be a state of M such that X;_i(s) G {E R ,R, T}, X,(s) = W, and 
X i+ i(s) G {E R ,R,F,W, D}. Let A be an adversary of Unit-Time, and let a be 
the execution of M that corresponds to an execution of H(M,A,{s}) where the 
result of the first coin flip of process i — 1 is left and the result of the first coin 
flip of process i + 1 is right. By Lemma 4.7.5, within time 4 either process i — 1 
reaches configuration P in a or process i reaches configuration S in a. If i — 1 
reaches configuration P, then we are done. If not, then let a = a-y ■ a 2 such that 
Istate(ai) is the first state s' of a with X 8 (V) = S . If i + 1 enters P before the 
end of o?!, then we are done. Otherwise, Xj + i(/sfafe(a 2 )) is either in {W, S } or 
it is in {E R ,R,F, D} and process i + 1 has not flipped any coin yet in a. From 
execution closure of Unit-Time we can then apply Lemma 4.7.6. Within one more 
time process i tests its second resource and enters P if process i + 1 did not check 
its second resource in the meantime. On the other hand, process i-\-l enters P if it 
checks its second resource before i does so. □ 

Lemma 4.7.10 Assume that X,_i G {E R ,R,F,W, D}, X { = W, and X i+1 G 
{E R ,R,T}. If FlRST(flip i _ 1 ,left) and FlRST(f lip i+1 , right), then within time 
5 one of the three processes i — 1, i or i -\- 1, enters P. 

Proof. Analogous to Lemma 4.7.9. □ 

Proposition 4.7.11 Starting from a global configuration in Q, then, with probabil- 
ity at least 1/4 and within time at most 5, some process enters P. Equivalently: 

1/4 
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Proof. Lemmas 4.7.7 and 4.7.8 jointly treat the case where X, = S and X J+1 G 
{E R , R, F, #} and the symmetric case where X 8 -_i G {E R ,R,F,i^} and X, = 
S; Lemmas 4.7.9 and 4.7.10 jointly treat the case where X, = W and X J+1 G 
{Fr, -R, F, W, D} and the symmetric case where X 8 -_i G {F_r, i?, -F, I'F, -D} and 

X 8 = IF. ^ ^ 

Specifically, each lemma shows that a compound event of the kind FlRST(flip i ,a;) 
and FlRST(f lip-, y) leads to V. Each of the basic events FlRST(f lip,, x) has prob- 
ability 1/2. From Proposition 4.4.2 each of the compound events has probability at 
least 1/4. Thus the probability of reaching V within time 5 is at least 1/4. □ 

We now turn to T — ► Q U V . The proof is divided in two parts and constitute the 

1/2 

global argument of the proof of progress. 

Lemma 4.7.12 Start with a state s of T . If there exists a process i for which 
Xi(s) = F and (Xi_i,X i+ i) ^ (#, #), then, with probability at least 1/2 a state of 
Q U V is reached within time 1 . 

Proof. The conclusion holds trivially if s G Q ■ Let s be a state oiJ-—Q and let i be 
such that Xi(s) = F and (Xi_i,X i+ i) ^ (#, #). Assume without loss of generality 

that X i+ i ^ #, i.e., X J+1 G {E R ,R,F, #}. (The case for X 8 -_i j^ # is similar.) We 
can furthermore assume that X J+1 G {E R ,R,F,D} since if X J+1 G {W, S} then s 
is already in Q . 

We show that the event NEXT((flip 8 , left), (flip i+1 , right)), which by Proposi- 
tion 4.4.2 has probability at least 1/2, leads in time at most 1 to a state oiQUV. Let 
A be an adversary of Unit-Time, and let a be the execution of M that corresponds 
to an execution of H(M,A,{s}) where if process i flips before process i + 1 then 
process i flips left, and if process i + 1 flips before process i then process i + 1 flips 
right . 

Within time 1, i takes one step and reaches W. Let j G {i,i + 1} be the first 
of i and i + 1 that reaches FF and let Si be the state reached after the first time 
process j reaches W. If some process reached P in the meantime, then we are done. 
Otherwise there are two cases to consider. If j = i, then, flip, gives left and 
Xi(si) = W whereas X J+1 is (still) in {E R , R, F, D}. Therefore, Si G Q ■ If j = i + 1, 
then flip i+1 gives right and X J+1 (s 1 ) = W whereas X 8 -(si) is (still) F. Therefore, 

Si eg. a 
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Lemma 4.7.13 Start with a state s of J 7 . Assume that there exists a process i for 
which Xi(s) = F and for which (X J _ 1 (s), X J+1 (s)) = ( #, #). Then, with probability 
at least 1/2, within time 2, a state of Q U V is reached. 

Proof. The hypothesis can be summarized into the form (Xi_i(s) , Xi(s) , X i+ i(s)) 
= (#,F, #). Since i — 1 and i + 1 point in different directions, by moving to the 
right of i + 1 there is a process k pointing to the left such that process k + 1 either 
points to the right or is in {E R , R, F}, i.e., X k (s) £ {W, S , D} and X k+ i(s) £ 
{E R ,R,F,W,S^,D}. If X k (s) £ {W, S_} then s £ Q and we are done. Thus, we 
can restrict our attention to the case where X k (s) = D. 

We show that the event NEXT((flip fc , left), (flipj, +1 , right)), which by Proposi- 
tion 4.4.2 has probability at least 1/2, leads in time at most 2 to Q U V . Let A be 
an adversary of Unit-Time, and let a be an execution of M that corresponds to an 
execution of H(M, A, {s}) where if process k flips before process k + 1 then process 
k flips left, and if process k + 1 flips before process k then process k + 1 flips right. 

Within time 2, process k takes at least two steps and hence goes to configuration W. 
Let j £ {k, k + 1} be the first of k and k + 1 that reaches W and let Si be the state 
reached after the first time process j reaches W. If some process reached P in the 
meantime, then we are done. Otherwise there are two cases to consider. If j = k, 
then, flip fc gives left and X k (si) = W whereas X k+ i is (still) in {E R , R, F, #}. 
Therefore, Si £ Q. If j = k + 1, then flipj, +1 gives right and X fc+1 (s 1 ) = W 
whereas X k (si) is (still) in {D,F}. Therefore, Si £ Q. □ 

Proposition 4.7.14 Start with a state s of T . Then, with probability at least 1/2, 
within time 2, a state of Q U V is reached. Equivalently: 

t -^ g u v. 

1/2 

Proof. The two different hypotheses of Lemmas 4.7.12 and 4.7.13 form a partition 
of T. □ 

Finally, we prove VJT — ► T U V . 

Proposition 4.7.15 Starting from a state s oflZT, then, within time 3, a state of 
T U V is reached. Equivalently: 

UT --^ T\JV. 
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Proof. Let s be a state of 1ZT. If s G J-, then we are trivially done: We can 
therefore restrict ourselves to the case where in s each process is in {E R , R, W, S, D} 
and where there exists at least one process in {W, S, D}. Furthermore we can restrict 
ourselves to the case where no process reaches V in time 3, i.e., where the state stays 
in 1ZT. (Else we are done.) Let A be an adversary of Unit-Time, and let a be the 
execution of M that corresponds to an execution of H(M,A, {«})• 

Within time 1 a process reaches {S,D,F}. Therefore Within time 2 a process 
reaches {D, F}. Therefore Within time 3 a process reaches {F}. As, by assumption, 
the state stays in 1ZT in time 3, we have therefore proven that T is reached in time 
3. □ 



Chapter 5 

A Deterministic Scheduling 
Protocol 



In this chapter we present a scheduling problem, analyze it and provide optimal 
deterministic solutions for it. The proof involves re-expressing the problem in graph- 
theoretical terms. In particular the main tool used in the proof of optimality is Ore's 
Deficiency Theorem [45] giving a dual expression of the size of a maximum matching 
in a bipartite graph. We will consider in Chapter 7 the randomized version of this 
scheduling problem. 



5.1 Introduction 

Many control systems are subject to failures that can have dramatic effects. One 
simple way to deal with this problem is to build in some redundancy so that the 
whole system is able to function even if parts of it fail. In a general situation, the 
system's manager has access to some observations allowing it to control the system 
efficiently. Such observations bring information about the state of the system that 
might consist of partial fault reports. The available controls might include repairs 
and/or replacement of faulty processors. 

To model the problem, one needs to make assumptions regarding the occurrence 
of faults. Typically, they are assumed to occur according to some stochastic pro- 
cess. To make the model more tractable, one often considers the process to be 
memoryless, i.e. faults occur according to some exponential distribution. However, 
to be more realistic, many complications and variations can be introduced in the 

113 
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stochastic model, and they complicate the time analysis. Examples are: a processor 
might become faulty at any time or only during specific operations; the fault rate 
might vary according to the work load; faults might occur independently among the 
processors or may depend on proximity. The variations seem endless and the results 
are rarely general enough so as to carry some information or methodology from one 
model to another. 

One way to derive general results, independent of the specific assumptions about the 
time of occurrence of faults, is to adopt a discrete time, that, instead of following 
an absolute frame, is incremented only at each occurrence of a fault. Within this 
framework, we measure the maximal number of faults to be observed until the 
occurrence of a crash instead of the maximal time of survival of a system until the 
occurrence of a crash. 

As an introduction to this general situation, we make the following assumptions and 
simplifications: 

Redundancy of the system: We assume the existence of a pool Af composed of p 
identical processors from among which, at every time t, a set s t of n processors 
is selected to configure the system. The system works satisfactorily as long as 
at least n — m processors among the n currently in operation are not faulty. 
However, the system cannot tolerate more than m faults at any given time: it 
stops functioning if to + 1 processors among these n processors are faulty. 

Occurrence of faults, reports and logical time: We consider the situation in 
which failures do not occur simultaneously and where, whenever a processor 
fails, a report is issued, stating that a failure has occurred, but without spec- 
ifying the location of the failure. (Reporting additional information might be 
too expensive or time consuming.) Based on these reports, the scheduler might 
decide to reconfigure the system whenever such failure is reported. As a result, 
we restrict our attention to the discrete model, in which time t corresponds to 
the i-th failure in the system. 

Repairs: No repair is being performed. 

Deterministic Algorithms: We assume that the scheduler does not use random- 
ness. 

Since the universe consists of only p processors, and one processor fails at each 
time, no scheduling policy can guarantee that the system survives beyond time p. 
(A better a priori upper bound isp— n + ra+1: at this time, only n — m — 1 
processors are still non-faulty. This does not allow for the required quorum of n — to 
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non-faulty processors.) But some scheduling policies seem to allow the system to 
survive longer than others. An obviously bad policy is to choose n processors once 
and for all and never to change them: the system would then collapse at time ra + 1. 
This chapter investigates the problem of determining the best survival time. 

This best survival time is defined from a worst-case point -of- view: a given scheduler 
allows the system to survive (up to a certain time) only if it allows it to survive 
against all possible failure patterns in which one processor fails at each time. 

Our informal description so far apparently constrains the faults to occur in on-line 
fashion: for each t, the i-th fault occurs before the scheduler decides the set s t+1 to 
be used subsequently. However, since we have assumed that no reports about the 
locations of the faults are available, there is no loss of generality in requiring the 
sets s t to be determined a priori. (Of course, in practice, some more precise fault 
information may be available, and each set s t would depend on the fault pattern up 
to time t.) Also, as we have assumed a deterministic scheduler, we can assume that 
the decisions s l7 . . . , s p are revealed before the occurrence of any fault. We express 
this by saying that the faults occur in an off-line fashion. 



5.2 The Model 

Throughout this chapter, we fix a universal set Af of processors, and let p denote 
its cardinality. We also fix a positive integer n (n < p) representing the number of 
processors that are needed at each time period, and a positive integer m representing 
the number of failures that can be tolerated (to < n). 

We model the situation described in the introduction as a simple game between two 
entities, a scheduler and an adversary. The game consists of only one round, in 
which the scheduler plays first and the adversary second. The scheduler plays by 
selecting a sequence of p sets of processors (the schedule), each set of size n, and the 
adversary responds by choosing, from each set selected by the scheduler, a processor 
to kill. We consider only sequences of size p because the system must collapse by 
time p, since, at each time period, a new processor breaks down. 

Formally, a schedule S is defined to be a finite sequence, s l7 . . . , s p , of subsets of A/", 
such that | Sj | = n for all t, 1 < t < p. An adversary A is defined to be a function 
associating to every schedule S = (si, . . . ,s p ) a sequence A(S) = (fi, . . . , f p ) of 
elements of M such that f t £ s t for every t. 

Now let S be a schedule, and A an adversary. Define the survival time, T(S,A), 
to be the largest value of t such that, for all u < t, \{fi, ■ ■ ■ f u } fl s u \ < m, (where 
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(/i, . . . , f p ) = A(S)). That is, for all time periods u up to and including time period 
t, there are no more than m processors in the set s u that have failed by time u. 

We are interested in the minimum survival time for a particular schedule, with 
respect to arbitrary adversaries. Thus, we define the minimum survival time for a 
schedule, T(S), to be T(S) = min^ T(S,A). An adversary A for which T(S) = 
min^t T(S,A) is said to be minimal for S. Finally, we are interested in determining 
the schedule that guarantees the greatest minimum survival time. Thus, we define 
the optimum survival time t opt , to be max 5 T(S) = max 5 min^ T(S,A). Also define 
a schedule S to be optimum provided that T(S) = t opt . Our objectives in this 
chapter are to compute t opt as a function of p, n and to, to exhibit an optimum 
schedule, and to determine a minimal adversary for each schedule. 



5.3 The Result 



Recall that 1 < m < n < p are three fixed integers. Our main result is stated 
in terms of the following function defined on the set of positive real numbers (see 
Figure 5.1): 
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where (x) + = max(i,0). In particular, h nrn (k) = —m when n divides k. 
The main result of this chapter is: 

Theorem 5.3.1 

''opt — ^n^myP ')• 

We will present our proof in two lemmas proving respectively that t opt is no smaller 
and no bigger than h nrn (p). 

Lemma 5.3.2 

'■opt -L- n nrn \J)j. 

Proof. Consider the schedule <S trivial in which the p processors are partitioned into 
|_-J batches of n processors each and one batch of q = p— [-\ n. Each of the first [-J 
batches is used m time periods and then set aside. Then, the last batch of processors 
along with any n — q of the processors set aside is used for (m-\-q — n) + time periods. 
It is easy to see that no adversary can succeed in killing m + 1 processors within a 
batch before this schedule expires. □ 
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Figure 5.1: The function h nrn (k) 

In order to prove the other direction of Theorem 5.3.1, we need the following result 
about the rate of increase of the function h nrn (k). 

Lemma 5.3.3 For < k and < / < n we have h nrn (k) < h nrn (k + /) + n — I — m. 

Proof. Notice first that h nrn (k) = h nrn (k + n) — m for all k > 0. Moreover, the 
function h increases at a sublinear rate (see Figure 5.1) so that, for p,q > 0, we have 
h n ,m(p + <?) < h nrn (p) + q. Letting p = k + / and q = n — /, we obtain 

K,m(k) = h n>m {k + n) - m < h n>m {k + I) + n - I - m, 

which proves the lemma. □ 

5.4 The Upper Bound 



In this section we establish the other direction of the main theorem. We begin with 
some general graph theoretical definitions. 

Definition 5.4.1 

• For every vertex v of a graph G, we let Jg( v ) denote the set of vertices adjacent 
to v. We can extend this notation to sets: for all sets C of vertices 7g(C) — 

Uv€C7g(v). 
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• For every bipartite graph G, v{G) denotes the size of a maximum matching 
of G. 

• For every pair of positive integers L,R, a left totally ordered bipartite graph 
of size (L, R) is a bipartite graph with bipartition £,1Z, where £ is a totally 
ordered set of size L and 1Z is a set of size R. We label £ = {a l5 . . .,a L } so 
that, a, < dj for every 1 < i < j < L. For every £' C £ and 1Z' C 7£, the 
subgraph induced by £' and 1Z' is a left totally ordered bipartite graph with 
the total order on £ inducing the total order on £' . 

• Let G be a left totally ordered bipartite graph of size (L, R). For t = 1, . . . , L, 
we let It(G) denote the left totally ordered subgraph of G induced by the 
subsets {a l5 a 2 , . . . , a t _{\ C £ and 7e( a t) ^ 7^.. 

Let us justify quickly the notion of left total order. In this definition, we have in mind 
that £ represents the labels attached to the different times, and that 1Z represents 
the labels attached to the available processors. The times are naturally ordered. 
The main argument used in the proof is to reduce an existing schedule to a shorter 
one. In doing so, we in particular select a subsequence of times. Although these 
times are not necessarily consecutive, they are still naturally ordered. The total 
order on £ is the precise notion formalizing the ordering structure characterizing 
time. 

Consider a finite schedule S = s l7 . . . , s t . In graph theoretic terms, it can be repre- 
sented as a left totally ordered bipartite graph G with bipartition T = {1, 2, . . . , T} 
and A/"={l,2,...,p}. There is an edge between vertex t G T and vertex i £ Af if 
the processor i is selected at time t. The fact that, for all t, \s t \ = n translates into 
the fact that vertex t G T has degree n. For such a bipartite graph, the game of the 
adversary consists in selecting one edge incident to each vertex t G T. 

Observe that the adversary can kill the schedule at time t if it has already killed, 
before time t, m of the n processors used at time t. It then kills another one at time 
t and the system collapses. In terms of the graph G, there exists an adversary that 
kills the schedule at time t if and only if the subgraph It(G) has a matching of size 
to, i.e. v(I t (G)) > to. Therefore, the set V that we now define represents the set of 
integers L and R for which there exists a schedule that survives at time L, when R 
processors are available. 

Definition 5.4.2 Let L and R be two positive integers. (L,R) G B iff there exists 
a left totally ordered bipartite graph G of size (L,R) with bipartition £ and 1Z 
satisfying the two following properties: 
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1. All vertices in C have degree exactly equal to n, 

2. For every t = 1,...,|£|, all matchings in It(G) have size at most equal to 
m - 1, i.e. v(I t (G)) < f - 1. 

The main tool used in the proof of Theorem 5.3.1 is the following duality result for 
the maximum bipartite matching problem, known as Ore's Deficiency Theorem [45]. 
A simple proof of this theorem and related results can be found in [39]. 

Theorem 5.4.1 Let G be a bipartite graph with bipartition A and B. Then the size 
v{G) of a maximum matching is given by the formula: 

v(G) = mm[\B-C\ + \ lG (C)\\. (5.1) 

OLD 

The following lemma is crucial for our proof. 

Lemma 5.4.2 There are no positive integers L and R such that (L,R) G B and 
such that L > h nrn (R). 

Proof. Working by contradiction, consider two positive integers L and R such 
that (L,R) G B and L > h nrn (R). We first show the existence of two integers L 1 
and R' such that L' < L, (L',R') G B and L' > h n>m (R'). 

Let C = {a l5 a 2 , . . . , a L } and 1Z = {&i, b 2 , ■ ■ ■ , b R } be the bipartition of the graph G 
whose existence is ensured by the hypothesis (L,R) G B. 

We apply Theorem 5.4.1 to the graph Il{G) where we set A = {a l5 a 2 , . . . , at-i} and 
B = 7g(«l)- Let C denote a subset of B for which the minimum in (5.1) is attained. 
(C is possibly empty.) Define CJ = L — ({«l} U 1i l (g){C)) and 1Z' = 1Z — C and let 
L' and R' denote the cardinalities of CJ and 1Z' . Hence, L' = L — 1 — \ji L (G)(C)\ so 
that L' < L. Consider the bipartite subgraph G' of G induced by the set of vertices 
C'UlZ'. In other words, in order to construct G' from G, we remove the set C U {a L } 
of vertices and all vertices adjacent to some vertex in C . We have illustrated this 
construction in Figure 5.2. In that specific example, ra = 4, to = 3, L = 6 and 
R = 7, while h A3 (l) = 5. One can show that C = {b 5 ,b 6 ,b 7 } and as a result G' is 
the graph induced by the vertices {a l5 a 2 , a 3 , a 4 , 6 l5 b 2 , b 3 , 6 4 }. The graph G' has size 
(L',R') = (4,4). 

We first show that (L',R r ) G B. Since the vertices in CJ correspond to the vertices 
of C — {a L } not connected to C, their degree in G' is also n. Furthermore, G', being 
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G 



G' 





Figure 5.2: An example of the construction of G' from G. The vertices in C are 
darkened. 



5.4. The Upper Bound 121 

a subgraph of G, inherits property 2 of Definition 5.4.2. Indeed, assume that there 
is a vertex a t i in G' such that I t i(G') has a matching of size m. Let t be the label of 
the corresponding vertex in graph G. Since the total order on CJ is induced by the 
total order on C, I t i(G') is a subgraph of It(G). Therefore, It(G) would also have a 
matching of size to, a contradiction. 

Let us show that L' > h nrn (R'). The assumption (L,R) G B implies that m — 1 > 
v{Il{G)). Using Theorem 5.4.1 and the fact that B = Jg(L) has cardinality n, this 
can be rewritten as 

f-l > v(I L (G))=\B-C\ + \ llLiG) (C)\ 

= n-\C\ + \ llL(G) (C)\. (5.2) 

Since C C B C TZ, we have that < \C\ < n < R and, thus, the hypotheses of 
Lemma 5.3.3 are satisfied for k = R — \C\ and / = \C\. Therefore, we derive from 
the lemma that 

h n>m (R') = h n>m (R - \C\) < h n>m (R) + n-\C\-f. 

Using (5.2), this implies that 

K, m (R') < KAR) ~ \li L (G)(C)\ - l. 

By assumption, L is strictly greater than h n/m (R), implying 

h n>m (R') < L - 1 - |7/ t(G )(C)|. 

But the right-hand-side of this inequality is precisely L', implying that L' > h n/m (R r ). 

We have therefore established that for all integers L and R such that (L,R) £ B 
and L > h n/m (R), there exists two integers L' and R' such that L' < L, (L 1 , R 1 ) G B 
and L' > h nrn (R'). Among all such pairs (L,R), we select the pair for which L is 
minimum. By the result that we just established, we obtain a pair (£', R 1 ) such that 
(L',R') G B and L' < L. This contradicts the minimality of L. 

□ 
Lemma 5.4.3 

'■opt J; ft"n,m(P)- 

Proof. By assumption, (t opt ,N) G B. Hence this result is a direct consequence of 
Lemma 5.4.2 . 

□ 
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This Lemma along with Lemma 5.3.2 proves Theorem 5.3.1. 

In the process of proving Lemma 5.3.2 we proved that (5 trivial is an optimum sched- 
ule. On the other hand, the interpretation of the problem as a graph problem also 
demonstrates that the adversary has a polynomial time algorithm for finding an op- 
timum killing sequence for each schedule S. When provided with S, the adversary 
needs only to compute a polynomial number (actually fewer than p) of maximum bi- 
partite matchings, for which well known polynomial algorithms exist (for the fastest 
known, see [31]). 



5.5 Extensions 

The problem solved in this chapter is a first step towards modeling complex resilient 
systems and there are many interesting extensions. We mention only a few. 

An interesting extension is to consider the case of a system built up of processors 
of different types. For instance consider the case of a system built up of a total of 
n processors, that is reconfigured at each time period and that needs at least §i 
non-faulty processors of type 1 and at least g 2 non-faulty processors of type 2 in 
order to function satisfactorily. Assume also that these processors are drawn from 
a pool A/i of pi processors of type 1 and a pool N 2 of p 2 processors of type 2, that 
A/i fl N-i = 0, that that there are no repairs. It is easy to see that the optimum 
survival time t opt is at least the survival time of every strategy for which the number 
of processors of type 1 and type 2 is kept constant throughout. Hence: 

t opt > max min(/i„ li „ 1 _ 3l (pi),/i„ 2i „ 2 _ 32 (p 2 )). 

{(ni,n 2 );ni+n 2 =n} 

It would be an interesting question whether t opt is exactly equal to this value or very 
close to it. 

Extend the definition of a scheduler to represent a randomized scheduling protocol. 
(Phrased in this context, the result presented in this chapter is only about deter- 
ministic scheduling protocols.) A scheduler is called adversary-oblivious if it decides 
the schedule independently of the choices / l5 f 2 , . . . made by the adversary. An off- 
line adversary is an adversary that has access to the knowledge of the full schedule 
Si, s 2 , . . . before deciding the full sequence s l7 s 2 , . . . Note that, by definition, off-line 
adversaries make sense only with adversary-oblivious schedulers. By comparison, an 
on-line adversary decides for each time t which processor f t to kill, without knowing 
the future schedule: at each time t the adversary decides f t based on the sole knowl- 
edge of Si, . . . , s t and of / l5 . . . , ft-i- In this more general framework, the quantity 
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we want to determine is 

t op t — raa,xmmE[T(S,A)]. (5-3) 

For an adversary-oblivious, randomized scheduler, one can consider two cases based 
on whether the adversary is on-line or off-line. As is easily seen, if the adversary is 
off-line, randomness does not help in the design of optimal schedulers: introducing 
randomness in the schedules cannot increase the survival time if the adversary gets 
full knowledge of the schedule before committing to any of its choices. As a result, 
the off-line version corresponds to the situation investigated in this chapter. 

It is of interest to study the online version of Problem 5.3. On-line adversaries model 
somewhat more accurately practical situations: faults naturally occur in an on-line 
fashion and the role of the program designer is then to design a scheduler whose ex- 
pected performance is optimum. We study this question for to = 1 in Chapter 7 and 
provide in this case a characterization of the set of optimal randomized scheduling 
policies. 
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Chapter 6 

Establishing the Optimality of a 
Randomized Algorithm 



Proving the precise optimality of a randomized algorithm solving a given problem 
V is always a very difficult and technical enterprise and only very few such proofs 
exist (see [25, 61]). 

A first difficulty is to define an adequate probabilistic model for the analysis of 
the randomized algorithms solving V . This model must take into account that, in 
general, some choices are not in the control of the algorithm considered but, instead, 
controlled by the adversary. It must also reckon with the fact that each randomized 
algorithm uses different random coins and hence carries a different probabilistic 
structure; nevertheless a common probabilistic structure has to be defined allowing 
for the comparison of all the algorithms solving V . The few papers published so 
far and dealing with lower bounds [25, 35, 33, 61] rarely address this issue. ([25] 
introduces an ad-hoc model for the proof presented there.) The model presented in 
Chapter 2 is, to our knowledge, the first to allow formal proofs of lower-bounds for 
general randomized algorithms. 

A second difficulty is that, for a given problem V, the set of randomized algorithms 
is infinite in general and hence looking for an optimal randomized algorithm involves 
doing a maximization over an infinite set. 

We let f(ir,A) denote the performance of a given randomized algorithm it when used 
in conjunction with an adversary A. Examples of typical performances f(ir,A) are 
the expected running time or the probability of "good termination" when the al- 
gorithm 7r is used in conjunction with the adversary A. By changing changing if 
necessary f(ir,A) into — f(ir,A) we can always assume that the algorithms it are 
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chosen so as to maximize the value f(ir,A). The worst case performance of an algo- 
rithm 7r is given by inf^ f(ir,A), and therefore the optimal worst case performance 
is given by sup^ inf^ f(ir,A). 

As discussed in Chapter 2, the problem of analyzing an algorithm - and proving its 
optimality - is best described in the language of game theory. (See also Section 8.3 
for a presentation of the main notions of Game Theory.) We let Player(l) be the 
entity selecting the algorithm (in short, the algorithm designer) and Player (2) be 
the entity selecting the adversary (in short, the adversary designer). If Player(l) 
selects the algorithm it and if Player (2) selects the adversary A, the game played 
consists of the alternative actions of the algorithm and the adversary: Player(l) 
takes all the actions as described by it until the first point where some choice has to 
be resolved by the adversary; Player (2) then takes actions to resolve this choice as 
described by A and Player(l) resumes action once the choice has been resolved... 

Note that, by definition, an algorithm it is defined independently of a given adversary 
A. On the other hand, an adversary might seem to be defined only in terms of a given 
algorithm: the adversary is by definition the entity that resolves all choices not in 
the control of the algorithm considered. If the model allowed for such an asymmetry 
between the notions of algorithm and adversary we could not speak of an adversary 
independently of the algorithm it would be associated to. For reasons that will soon 
be explained, it is critical for our method to model adversaries independently of any 
specific algorithm. In this case the algorithm designer and the adversary designer 
are two well defined players playing a zero sum non-cooperative game. The set of 
strategies II and A are respectively the algorithms it and the adversaries A. The 
rules governing the interaction of the two players during an execution of the game 
are set by the description of the problem V . 

A very delicate matter is the nature of the information about the system held by 
either player when taking a step, and the formal way this information is taken into 
account in the model. Generally, some information about the moves of either player 
is conveyed onto the other player during the execution (i.e., during the game). A 
player having a more precise knowledge of the state of the system is more capable to 
act optimally toward its goal (maximizing or minimizing the performance function 
f(ir,A)). The proof of optimality of a player is therefore tantamount to proving 
that, at each round, the player uses optimally the information available in order to 
take its next move. This is in general a very difficult task for which no clear general 
approach seems to exist. Nevertheless, using the concept of saddle point in game 
theory allows us to derive a general proof strategy for proving the optimality of an 
algorithm. We now present and discuss this methodology. 
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If adversaries are each defined independently of any specific algorithm 7r, for every 
adversary A we can consider the family (f(ir,A)) obtained by letting it range over 
the whole set of algorithms. Therefore, in this case, for every adversary A, the 
quantity sup^ f(ir,A) is well-defined. 

By Lemma 8.2.2, for every algorithm 7r and every adversary Aq we have inf^ f(ir ,A) 
< sup,,. f(ir,Ao)- Furthermore, this inequality is an equality only if 7r is an optimal 
algorithm. This simple fact provides us with the following general proof methodol- 
ogy to attempt to prove that a given algorithm 7r is optimal. 



1. Construct a II/A-structure modeling the interaction between Player(l) 
and Player (2). (This means in particular that an adversary is defined 
independently of the choice of any specific algorithm.) 

2. Provide an adversary Aq such that inf^ f(ir ,A) = sup^ f(it,Ao). 



By Proposition 8.2.3, the existence of a pair (ir , Ao) realizing the equality inf^ /(7r , 
A) = sup^ f(ir,Ao) occurs if and only if max, inf^ f(ir,A) = min^ sup^ f(ir,A). 

(This equality succinctly expresses the three following facts. 1) sup^ inf^ f(ir,A) = 
inf^t sup^ f(ir,A). 2) A protocol it achieves the sup in sup^ inf^ f(ir,A)i.e., sup^ inf^t 
f(ir,A) = max, inf^t f(ir,A). And 3) an adversary A achieves similarly the inf in 
min^ sup^ f(ir,A) i.e., inf^ sup^ f(ir,A) = ram A sup^ f(ir,A).) 

To find an algorithm and prove its optimality using the previous methodology, we 
are therefore led to model algorithms and adversaries in such a way that the equal- 
ity sup^ inf^t f(ir,A) = inf^ sup^ f(ir,A) holds. There exists two cases where this 
happens: 

Von Neumann: We assume that the set II of strategies of Player(l) is the set 
of probability distributions on a given finite set / and that, similarly, the set 
A of strategies of Player(2) is the set of probability distributions on a given 
finite set J. When saying this, we actually abuse language and identify a 
probability distribution with the procedure consisting in drawing an element 
at random according to this probability distribution. Hence, by convention, 
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for every it £ II, the strategy it consists in drawing an element i of / at 
random and according to the distribution it. Similarly, for every A £ A, the 
strategy A consists in drawing an element j of J at random and according 
to the distribution A. For every (i,j) £ I X J and every strategies it and A 
resulting in the selection of i and j, a predetermined cost T(i,j) is incurred. 
The performance f(ir,A) is by assumption the expected cost E W ^[T] obtained 
under the strategies it and A. 

The game just described can be encoded as a matrix game: / and J are the 
sets of pure strategies whereas II and A are the sets of mixed strategies of the 
game. By Von Neumann's theorem, (see Theorem 8.3.2), max^ min^ f(ir,A) = 
min^t max,r f(ir,A). Recall once more that the finiteness of both / and J is 
critical for this result. 

Strong Byzantine: Assume that the rules of the game played between Player(l) 
and Player(2) specify that, in every execution, Player(2) first learns explicitly 
the strategy it chosen by Player(l) before having to commit itself to any action. 
(We could picture this by saying that, by convention, an execution begins with 
Player(l) "sending a message" to Player(2) disclosing the strategy it under 
use.) Hence, in this situation, a strategy A for Player(2) is actually a family 
A = (An)^ of strategies A w , one for every strategy it of Player(l). We say 
that A w is an adversary specially designed for it. Assume furthermore that the 
performance function is such that, for every adversaries A and A', for every 
algorithm 7r, if A w = A' n then f(ir,A) = f(ir,A'). This last property allows 
us to extend the definition of /: for every algorithm it and every strategy a 
specially designed for 7r, we set f(ir,a) = f(ir,A) where A is any adversary 
such that A w = a. Assume also that A is stable under reshuffling in the 
following sense. Let («(vr)) be a family of specially designed adversaries, one 
for every it £ II. (Hence, by definition, for every it and it' in n, there exists 
an adversary A and an adversary A' such that A w = a(ir) and A' n , = a(ir'). 
The adversaries A and A' are a priori different.) Then (a(ir)) is itself an 
admissible adversary, i.e., an element of A. 

The definition A = (A^)^ immediately shows that an adversary A does not 
depend on the choice of a specific algorithm. Hence the Strong Byzantine 
setting verifies point 1 of our general methodology. 

We now show that, in this setting, sup n mf ^ f (it, A) = mf ^ sup n f (it, A) and 
that, therefore, an algorithm 7r is optimal if and only if there exists an ad- 
versary Ao such that inf^ f(ir ,A) = su~p n f(ir,Ao)- This will show that the 
Strong Byzantine setting is well suited for an implementation of our general 
methodology. 
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For every e > and every it in II - the set of strategies of Player(l) - let 
A^ie) be an adversary specially designed for it and such that 

f(ir,A n (e)) <inf/(7r,^) + e. 

The set A of adversaries being stable under reshuffling we can define an ad- 
versary A(e) by A(e) = (A jr (s)) . We have: 

inf sup/(vr,yl) < sup /(vr, .4(e)) 
= sup/(7r,A(e)) 

7T 

< supinf f(ir,A) + £ . 

The parameter e being arbitrary, this shows that inf^ sup,,. f(ir, A) < sup^ inf^t 
/(vr, A). By Lemma 8.2.1 the converse inequality sup^ inf^t f(ir,A) < inf^t sup^- 
f(ir,A) holds trivially. Hence sup^inf^ f(ir,A) = mf ^ sup n f (it, A) which 
concludes the proof. 



We present here an intuitive interpretation of this result. 

Recall first that, as discussed in Page 207, in the expression sup^ inf^ f(ir,A), 
Player(2) can be assumed to learn implicitly the strategy it chosen by Player(l). 
Symmetrically, in the expression inf^ sup^ f(ir,A), Player(l) learns implicitly 
the strategy A chosen by Player (2). Furthermore, as discussed after Equa- 
tion 8.4, Page 206, the strict inequality sup^ inf^ f(ir,A) < inf^ sup^ f(ir,A) 
means precisely that the outcome of the game is different according to which 
of the two players can thus learn its opponent's strategy. 

If, by construction, Player(2) is informed explicitly of the strategy used by 
Player(l), its knowledge is evidently unaffected by whether it furthermore 
learns this fact implicitly (as in the expression sup^ inf^ f(ir,A)) or not (as 
in the expression inf^ sup^ f(ir,A)). Let Aq be the strategy for Player(2) 
informally described by "Wait for the disclosure of the strategy it selected 
by Player(l). Then select an optimal strategy to be adopted for the rest of 
the game." It is clear that Aq is an optimal strategy for Player (2). Assume 
that Player(2) plays optimally and adopts this strategy and consider the case 
where Player(l) learns implicitly that Player(2) uses strategy Aq. We easily 
see that this knowledge does not confer any advantage to Player(l): Player(l) 
can only derive from it that, for every strategy it it elects, Player(2) chooses 
a corresponding optimal strategy. 
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This establishes that, when Player (2) is informed explicitly of the strategy 
used by Player(l), Player(2) gains no additional advantage in learning im- 
plicitly the strategy it used by Player(l); and that, in this case, Player(l) 
gains similarly no advantage in being guaranteed that Player(2) uses its (op- 
timal) strategy Aq. This shows that, when Player (2) is informed explicitly 
of the strategy used by Player(l), the outcome of the game is not affected 
when one or the other player learns implicitly its opponent's strategy. As ar- 
gued at the beginning of this discussion, this means that sup n mf ^ f (it, A) = 
inf^t sup,,. f(ir,A) for every Strong Byzantine game. 

As a short aside and to illustrate the generality of our proof methodology we show 
that the complicated proof of given in [25] falls in the framework of the Strong 
Byzantine case of the methodology. (In [25], Graham and Yao consider the Byzan- 
tine Generals problem with 3 processes, one of which is faulty.) 

By assumption Player(2) knows the algorithm it selected by Player(l). (This point 
is never stated explicitly in [25]: the authors of [25] just mention that they "have 
incorporated the capability for faulty processes to collude, to spy on all commu- 
nication lines and to wait for messages transmitted by non-faulty processes in the 
current round to arrive before making decisions on their own messages." Neverthe- 
less the strategies o A ,a B and a c of Player(2) are described in terms of it.) Hence, 
as discussed in page 128, a strategy A of Player(2) is actually a family (A^)^ and 
does not depend on the choice of a specific it. 

The performance function is defined to be 

f(ir,A) = P-K^Ad 00 ^ termination] , 



where P Wy A w lS the probability on the set of executions induced by the algorithm 
7r and the adversary A w specially designed for it and associated to A. The event 
good termination is a special event defined in terms of the game studied in [25]. 
The definition of f(ir,A) shows immediately that f(ir,A) = f(ir,A') if A w = A' n . 
Furthermore, the set A of adversaries considered in [25] is by assumption stable 
under reshuffling. We are therefore in the Strong Byzantine setting of the general 
methodology. We now summarize the proof presented in [25] and show that it follows 
precisely our general methodology. 

The proof of [25] is organized as follows. A specific algorithm 7r is first given 
for which the quantity performance(ir ) = inf^ f(ir ,A) is easily derived. 1 A spe- 
cific (but very complex) strategy Aq for Player(2) is then described. In order to 



This algorithm is actually called Ao in [25]. We use 7To to be consistent with the rest of our 
discussion. 
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implement strategy Ao, 2 Player (2) uses critically its knowledge of the strategy it 
used by Player(l): at every point of the game (i.e., of the execution) Player(2) 
selects its next move by emulating it under certain conditions. Working by in- 
duction on the number of rounds of the algorithm it selected by Player(l), [25] 
then shows that, for every it, f(ir,Ao) < performance^ q). This implies that 
sup w f (it, Ao) < performance(ir ) = inf^ f(ir ,A). By Lemma 8.2.2, the converse 
inequality sup,,. f(ir,Ao) > inf^ f(ir ,A) is trivially true. Hence 

sup/(vr, Ao) = inf /(vr ,yl), 

which establishes the second point of our general proof methodology and therefore 
proves that 7r is optimal. 



A natural question is whether the two previous settings, although different in form, 
are truly different. In slightly more precise terms, the question is whether the 
existence of a proof of optimality of a given algorithm 7r in one of the two settings 
implies the existence of a proof of optimality of 7r in the other setting. 

The following argument tends to suggest a similarity between the two settings. (At 
least when the performance function f(ir, A) is equal to the expected value E W ^[T] of 
a random variable T: recall that the Von Neumann setting requires this condition.) 

Let (G,H,A) be a game 3 between Player(l) and Player(2) with a performance 
function /. Consider all the possible modifications of this game obtained by provid- 
ing Player(2) during the execution of the game with some information about the 
strategy it followed by Player(l). All these different games yield the same value 
sup^ inf^t f(ir,A), because, as discussed in Page 207, Player(2) can be assumed 
to learn implicitly the complete strategy it in the expression sup^ inf^ f(ir,A): re- 
ceiving some complementary explicit information about it does not then raise its 
knowledge. This shows that there is a whole spectrum of models for the adver- 
sary and that to all of them is attached the same class of optimal algorithms. The 
two settings presented above, the "Von Neumann setting" and the "Strong Byzan- 
tine setting", correspond to two extreme situations where Player(2) receives only a 
bounded number of bits of information about it in the course of an execution, and 
where it receives the complete description of it at the very beginning of the game. 
The argument above seems to suggest that the two settings are equally good to 
establish the optimality of a randomized algorithm. 



More precisely, in order to implement Ao,n, the adversary associated to Ao and specially de- 
signed for 7T. 

See page 205 for a discussion on game theory. 
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We now discuss two examples, the algorithm of [25], (again), and the scheduling 
algorithm presented in Chapter 7. These examples reveal that the choice of the 
setting actually influences greatly the proof of optimality of a randomized algorithm. 

Consider first the scheduling problem considered in Chapter 7. The performance 
function f(ir,A) considered is the expected value E W ^[T] of a random variable T 
called the survival-time. In this game, Player (2) does not know a priori the strategy 
selected by Player(l). This is formally seen in the model presented in Section 7.2: 
at each time t, the view of Player {2) contains the schedule Si,...,s t previously 
selected by Player(l) but contains no additional information about the algorithm 
7r that generated that schedule. We prove that all the algorithms in the set Prog 
defined in page 151 are optimal. Our discussion above therefore shows that these 
algorithms would similarly be optimal if Player (2) was endowed with the spying 
capability and learned the strategy selected by Player(l) at the beginning of the 
execution. Nevertheless, the proof that we present uses critically that Player (2) 
does not have this capability: if Player (2) was modeled as knowing the algorithm 
7r, our Lemma 7.3.2 would not be true and all the results of Section 7.6 would not 
hold anymore. 

We consider now the Byzantine Generals problem of [25] and show that, in contrast 
to the previous example, both the Strong Byzantine setting and the Von Neumann 
setting can be used to formalize the proof given by Graham and Yao. 

The performance function f(ir,A) considered in [25] is the probability of termination 
with agreement on a correct value when Player(l) selects selects the algorithm it 
and Player (2) plays according to the strategy A. A probability being a special 
case of an expected value, the performance function f(ir,A) is the expected value 
Ek,a[T] of some variable schema 4 T. 

We argued on page 130 that Graham and Yao use the strong byzantine setting in 
their proof: their Player (2) uses as a black box the algorithm it chosen by Player(l) 
in order to generate its own outputs in the course of the execution. Nevertheless an 
even more careful reading of their proof reveals that Player (2) does not need the 
full knowledge of it but just needs to have access to finitely many values produced 
by it. Hence we could consider a setting where, by convention, Player(l) would 
provide Player (2) with those values: in that case Player (2) would need no additional 
knowledge about it. As argued above on page 131, in this modified game - where 
Player(l) gives some partial information about its strategy - the algorithm 7r of [25] 
is still optimal. But we are now in the Von Neumann setting (when analyzing 
algorithms terminating in finitely many rounds). 



The definition of a variabie schema is given in Definition 2.4.1. 
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We have thus argued that, by reducing the information transmitted to Player (2) 
from the complete description of it to only finitely many bits of information we 
could adapt the proof of [25] given in the Byzantine setting into one given in the 
Von Neumann setting. We could go further and consider the case where Player(l) 
does not cooperate with Player(2) and provides Player(2) with no information about 
its strategy (except for what can be "naturally" deduced from an execution). The 
discussion given above on page 130 shows as before that the algorithm 7r of [25] is 
still optimal. Nevertheless, in this case, the proof of [25] does not apply and it is 
not clear at all how a direct proof would then proceed. 

These two examples show that the choice of setting is far from innocent and influ- 
ences greatly the proof of optimality of a randomized algorithm. We present in the 
next theorem a result establishing formally that the two settings are in some cases 
incompatible. 

Theorem 6.0.1 Let V be a problem, let II be the set of randomized algorithms 
solving V and A be the set of adversaries. Assume that II contains more then 
one element. Assume also the interaction between the two players modeled to allow 
Player(2) to know the algorithm it under use. Then the Von Neumann setting cannot 
be used to model the interaction between Player(l) and Player (2). 

Proof. Note first that the Von Neumann setting applies only if the sets II and 
A of strategies contain all the convex combinations of their elements: for every 
strategies 7Ti and 7r 2 in II, for every non-negative numbers o^ and a 2 summing to 
one, a 1 7r 1 -|-Q!2vr2 is also in II. (Recall that, by definition, in the Von Neumann setting, 
the strategies 7Ti and 7r 2 are probability distributions so that the linear combinations 
aiiTi + a 2 iT2 are well defined.) Hence, in the case where the Von Neumann setting 
applies, the set II is either a singleton or an infinite set. (The case where II is 
a singleton is a degenerate case where Player(l) has only one strategy, which is 
trivially optimal. 5 ) 

Also, in the case where the Von Neumann setting applies, a single probability space 
(Q,G) can be used to analyze the probabilistic behavior of all the pairs (ft, A) of 
algorithm and adversary. This probability space can be chosen to be the product 
space £1 = I X J endowed with its complete u-field Q = 2°: S7 and Q are both finite. 

In the general case, we saw in Chapter 2 that the construction of an adequate 
probabilistic structure is more complicated and yields a possibly different space 
(Qw,a> 0tt,a) f° r every pair (it, A). Consider the case, where, as when the Von Neu- 
mann setting applies, a single space (0, Q) is used for all the pairs (it, A). The sample 



3 Remember that all this discussion is geared at finding an optimal algorithm! 
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space S7 must contain a different element uj for each possible execution i.e., for each 
sequence of actions (acti, act 2 , act 3 , . . .) arising from the game played by Player(l) 
and Player (2). 

Assume the interaction between Player(l) and Player(2) modeled to allow Player(2) 
to know the algorithm it under use. Therefore, by assumption, in every execu- 
tion, there must be a move (or a sequence of moves), specific to 7r, undertaken by 
Player(l), and informing Player(2) of the strategy it chosen. 

Working by contradiction, assume that we could use the Von Neumann setting to 
model the game between Player(l) and Player(2). This means that the set II can 
be represented as a set of probability distributions on a given finite set /, and that, 
similarly, the set A can be represented as a set of probability distributions on a 
given finite set J (and that the performance f(ir,A) is the expected value E W ^[T] 
of a random variable T). In that case the sample space S7 is equal to I X J and is 
therefore finite. 

On the other hand, as discussed above, in that case, the set II must be infinite. 
As in each execution Player(l) informs Player(2) of its strategy 7r, the set of dif- 
ferent executions must therefore also be infinite. This implies that S7 is infinite, a 
contradiction. □ 



Chapter 7 

An Optimal Randomized 
Algorithm 



In this chapter we consider the scheduling problem studied in Chapter 5 but al- 
low algorithms to use randomness. The terms protocol and algorithm are synony- 
mous but for notational emphasis we favor here the use of protocol: the notations 
II, 7r , P w , F 'generating will refer to protocols whereas the notations A,A,P^, Agen- 
erating will refer to adversaries. 

Using the general model presented in Chapter 2 we construct a II/A-structure as- 
sociated to the scheduling problem. This allows us to characterize very precisely 
the optimization problem. We provide a specific randomized protocol and give a 
completely formal proof of its optimality. 

This proof is to our knowledge the first completely formal proof of optimality of 
a randomized algorithm. 1 This chapter should therefore illuminate the power and 
relevance of the model presented in Chapter 2. 



7.1 The Scheduling Problem 

7.1.1 Description of the problem 

We recall quickly here the setting of the problem, m, n and p are three non-negative 
integers such that 1 < m < n < p. 



The proof given by Graham and Yao in [25] still needs some fine tuning. 

135 
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• p is the total number of processors available. 

• n is the number of processors that are necessary to configure the system: at 
each time n processors are in operation. 

• We assume that a processor can become faulty only when in operation and 
that faults occur one at a time. We also assume that no repairs are available. 
m is the resiliency parameter of the system: the system functions as long as 
the set of n processors selected does not include more then m faulty processors. 
The system crashes as soon as the set of n processors currently in use includes 
at least m + 1 faulty processors. 

We define the discrete time t of an execution to be the execution point at which the 
i-th fault occurs. In the sequel, we write time instead of discrete time. 

We consider the blind situation where, during an execution, the scheduler is informed 
of the occurrence of a fault whenever one occurs, but does not get any additional 
information about the location of this fault. Upon notification of a fault the sched- 
uler reconfigures the system. We let Si denote the set of n elements selected for 
the first time and, for t > 2, we let s t denote the set of n elements selected after 
report of fault t — 1 (i.e., after time t — 1). We also let / l5 (fi £ Si), denote the 
location of the first fault and generally we let f t , (f t £ s t ), denote the location 
of the i-th fault. For the sake of modeling we say that the sequence / l5 / 2 , . . ., is 
decided by an entity called the adversary. The purpose of this work is to find a 
scheduling protocol guarantying the best expected survival time against worst case, 
on-line adversaries. This means that, when selecting the i-th location of fault f t , 
the adversary "knows" the whole past Si, fi,s 2 , f2, •••,*<• We can equivalently say 
that, for each t, the adversary "receives the information" of what the choice s t of the 
scheduling protocol is before deciding what the next fault is. Note that, by contrast, 
expressed in this language of on-line information, the assumption that the protocol 
is blind means that, for each t, the scheduling protocol "receives no information" 
about the choices previously made by the adversary before deciding itself what the 
set s t is. We will provide in Section 7.2 a formal setting allowing to interpret these 
notions of knowledge. 

7.1.2 Interpretation using game theory 

The purpose of this section is to present some intuition for the formal model pre- 
sented in Section 7.2. Some notions as the notion of actions, internal and external, 
that we introduce in the course of the discussion are not presented formally but 
should be clear from the context. 
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Following the methodology outlined in Chapters 2 and 6 we describe the scheduling 
problem presented in Section 7.1.1 as a game played between two players Player(l) 
and Player(2). We will refer to this game as the "scheduling game". In this setting, 
a protocol is a strategy of Player(l) and an adversary is a strategy of Player(2): 
Player(l) is called the protocol-designer and Player(2) is called the adversary- 
designer. The game played by the two players follows the rules of the scheduling 
problem described in Section 7.1.1: Player(l) plays first, chooses Si and informs 
Player(2) of its decision. Player(2) then plays and selects fi in Si. No informa- 
tion is conveyed from Player (2) to Player(l). More generally, in the i-th round, 
Player(l) selects a set s t and informs Player (2) of its choice; Player (2) then plays 
and selects an element f t in s t . We adopt the model where Player (2) does not know 
explicitly the strategy it followed by Player(l). 2 (In the model where Player (2) 
knows explicitly the strategy it followed by Player(l), Player(l) "sends a message" 
informing Player (2) of the strategy selected by Player(l).) 

As discussed in Chapter 6, Page 134, for every protocol it and for every adver- 
sary A the sample space S7 must contain a different uj for each possible execution 
i.e., for each sequence of actions (acti, act 2 , act 3 , . . .) undertaken in the game played 
by Player(l) and Player (2) when following the rules of the scheduling game. Some 
care has to be devoted to characterize the actions that we here consider. A specific 
protocol (or adversary) can be implemented in various ways, each of them having 
specific internal actions. Nevertheless, internal actions are irrelevant for the per- 
formance analysis of a protocol: the performance analysis of a protocol is solely 
measured in terms of its external actions, i.e., the specific actions it undertakes as 
prescribed by the rules of the game. In a figurative sense, we treat a protocol (resp. 
an adversary) as a black box and only analyze its external actions. 

In our scheduling game and in the model where Player (2) does not know the strategy 
7r followed by Player(l), the external actions undertaken by Player(l) are the suc- 
cessive choices of a set s t and communications to Player (2) of the choice last made. 
To simplify the discussion we will omit explicit reference of the communication be- 
tween Player(l) and Player (2) and implicitly assume that this communication is 
systematically (and instantaneously) performed at each selection of a set s t . Simi- 
larly, the external actions undertaken by Player (2) are the successive choices of an 
element f t in the set s t last selected by Player(l). To simplify further the discus- 
sion we will abuse language and speak of the actions s t and f t in place of "choice 
of s t " and "choice of f t v . The assumption m < p clearly implies that the system 
cannot survive more then p faults. We can therefore restrict our analysis to the 



"See Section 8.3 and Chapter 6 for a presentation of the notions of explicit /implicit knowledge. 
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times t = 1, . . . ,p. From this discussion we deduce that the sample space 

^ = {(•Si,/i,...,Sp,/ P ); s t £ V n {p), f t £ s t , 1 <t <p) 

is big enough for the probabilistic analysis. 

This definition is in conformity with the general construction given on page 41 of of 
Chapter 2. For every protocol it and every adversary A we defined there 

0,^ = {uj ; oj is a (7r,.4)-execution}, 

where 

u = a 1 (s u x u y 1 ) a 2 (s 2 ,x 2 ,y 2 ) a 3 (s 3 ,x 3 ,y 3 ) . .. 

S v "• v "• v ' 

Player(2) Player(l) Player(2) 

The discussion given on page 42 shows that, for every t, (s t , x t , y t ) is a deterministic 
function of a l5 . . . ,a t so that, from a probabilistic point of view, an execution can 
equivalently be defined to be the sequence a l7 a 2 , . . . This is the definition adopted 
in this chapter. 

We have so far informally defined protocols and adversaries to be the strategies of 
Player(l) and Player(2), respectively. We now discuss how these notions can be 
formalized, beginning with the notion of adversary. Our construction is a direct 
application of the general construction given in Chapter 2. 

We define an adversary to be a family of probability distributions (Q V ) V £V, one 
for each v m V: V is the set of all the possible views that Player (2) can have of 
the system at any time of the game i.e., at any time of the execution. (We will 
make this more explicit in Section 7.2.) For every element /, the quantity Q v (f) 
represents the probability that Player (2) chooses / if its view of the system is v. 
Note that, according to the general presentation made in Chapter 2, we should define 
an adversary to be a family of probability spaces (£l v ,Q v ,P v ) ve v Nevertheless we 
can take all the measurable spaces (fl v ,G v ) to be equal to ({1, . . ., JV}, 2* 1, •••■■^l). 
This allows us to omit mentioning (£l v ,G v ) in the definition of the adversary. 

Note that a family (f v ) veV , i- e - 5 the choice of an element f v for each view v in V, 
corresponds to a decision tree of Player (2). 3 As the number of rounds of a game is 
bounded and as, at each round, the number of different actions of both players is 
also bounded, the number of decision trees of Player (2) is similarly bounded. In this 
case it is easy to see that the set of strategies of Player (2), i.e., the set of families 



Actually a decision tree corresponds to a "weeded out" family (fv)vev' t where V' is a maximal 
subset of V having the property that each view v in V is compatible with the choices f w made 
previously by the player. Nevertheless, the extension to the set of all views is inconsequential and 
we adopt for simplification this characterization of a decision tree. 
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(Qv)veVi is in one-to-one correspondence with the set of probability distributions 
on decision trees. 

We could therefore equivalently define an adversary to be a probability distribution 
on the set of decision trees (of Player {2)). We say that the definition in terms of a 
family (Q v ) ve v adopts the local point of view whereas the definition in terms of a 
decision tree adopts the global point of view. Let us emphasize that the equivalence 
of these two points of view depends on the finiteness of the number of decision trees. 4 

Following the same model for Player(l) we could define a protocol to be a family 
(Pu)ueu of probability distributions, one for each possible view u that Player(l) can 
have of the system at any time of the game. 5 Nevertheless, as by assumption the 
protocol receives no information from the adversary, we find it easier to adapt the 
global point of view: in this case a decision tree (of Player(l)) is simply a sequence 
(si, . . . , s p ) in V n {p). We therefore define a protocol to be a probability distribution 
on V n (p). 

Note that the distinction between protocol and protocol-designer (resp. between 
adversary and adversary-designer) is often not kept and we refer to properties of 
the protocol (resp. the adversary) that should be more properly attributed to the 
protocol-designer (resp. the adversary-designer). A case where both points of views 
are equally valid is when we refer to the decisions done by the protocol or by the 
protocol-designer: the protocol is the strategy used by the protocol-designer for its 
decision making. By contrast, when speaking of "the knowledge held by the adver- 
sary" or of "the information received by the adversary" we should more correctly 
speak of the knowledge held by the adversary-designer: by definition, an adversary 
A is a family (Q v ) v of probability distributions which receives no information. On 
the other hand, Player(2), the adversary-designer, does receive some information 
during an execution and uses this information as prescribed by its strategy A. 



This duality is well known, but not everyone realizes the caveat about finiteness. For instance 
Hart et al. say in [29] and we quote: "There are two main ways of introducing randomizations ... 
The first consists of a random choice of the next process at each node of the execution tree ... The 
second way consists of taking a probability distribution over the set of deterministic [executions] 
(i.e., make all the random decisions a priori.) ... It is easy to see that the first case (independent 
randomization at each decision node) is a special case of the second one (by doing all randomizations 
at the start!) ,, Note though that, in the case of infinite executions, it is not trivial to convert "the 
first way" into "the second way". This is actually the heart of the problem in the construction of 
the probability distribution Pj\ given on page 41. 

As previously for the adversary, note that, according to the general presentation made in 
Chapter 2, we should actually define a protocol to be a family of probability spaces (fi u , Qu, Pu)ueu- 
Nevertheless we can take all the measurable spaces (Q. u ,Qu) to be equal to (P„(p),2 nt ~ p >'). This 
allows us to omit mentioning (fi u , Qu) in the definition of the adversary. 
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As is established in Chapter 2, a given strategy it of Player(l) and a given strategy A 
of Player(2) define a unique probability distribution P Wt A on the set S7 of executions. 
We will give a precise characterization of P Wt A in Section 7.2. We will also define 
there formally the random variable T representing the survival time. With these 
notions, the optimal expected survival time achievable against every adversary is 

supinf E W<A [T] . 

IT A 

Note that we adopt here the Von Neumann setting described in Chapter 6: for each 
of the two players the set of pure strategies is the finite set of decision trees of that 
player. Hence, by Von Neumann's theorem, (see Theorem 8.3.2), 

supinf E W<A [T] = inf sup E^fT] , 

TT A A 1! 

and the general proof methodology described in Chapter 6, Page 127, applies. Our 
proof will follow this methodology. 

The rest of the chapter is organized as follows. In Section 7.2 we formalize the 
previous discussion and construct the probabilistic model used in the subsequent 
sections. In Section 7.3 we define for every it and A two pseudo-probability dis- 
tributions P w and P A which play a crucial role in the proof. (The denomination 
"pseudo-probability distribution" refers to the fact that P w and P A are not prob- 
ability distributions but that, as is asserted in Lemma 7.3.4, some "conditional" 
variants of them are well defined probability distributions.) Section 7.4 describes 
a class Prot(Prog ) of protocols 7r and an adversary Aq. The main result of this 
chapter which is presented in Theorem 7.4.6 asserts that 7r and Aq verify point 2 of 
the methodology given in Page 127, and hence that every protocol 7r G Prot(Prog ) 
is optimal: 

sup E^JT] = E WOtAo [T] = inf E WoA [T] . 

The proof of this theorem is the object of the rest of the chapter. Section 7.5 presents 
some random variables that are fundamental for the proof. Section 7.6 establishes 
that snp n E wAo [T] = E WOiAo [T]. Similarly, Section 7.7 establishes in essence that 

inf A E WOiA [T] = E WOiAo [Tl 
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7.2 The Probabilistic Model 

We formalize here 1) the notions of protocol and adversary and 2) the probability 
spaces that will be used in the subsequent analyses. Recall that a protocol is a 
strategy of Player(l) and that, similarly, an adversary is a strategy of Player(2). 

For every t, 1 < t < p , a sequence a = (si,s 2 , ■ ■ ■ , s t ) in V n (p) is called a t-schedule 
and a sequence <^> = (/ l5 . . . , f p ) of elements of [p] is called a t-fault-sequence. A 
t- fault- sequence (f> is adapted to a schedule <7 if /j £ Sj for all j, 1 < j ' < t, and if, for 
all j, the condition Sj $Z {/ l5 . . . , fj-i} implies that fj £ Sj — {/i, . . . , /j_i}. 

A t-execution is an alternating sequence cj = (si, /i, s 2 , / 2 , . . . , s t , / t ) obtained from 
a ^-schedule (s l7 . . . , s t ) and a i-fault-sequence (/ l5 . . . , / t ) adapted to (s l7 . . . , s t ). A 
t-odd execution is a sequence cj = (s l7 / l5 s 2 , /2, . . .,s t ) obtained from a ^-schedule 
(si, . . ., s t ~) and a(- 1-fault-sequence (/ l5 . . . , ft-i) adapted to (s l7 . . . , s t _i). For 
simplicity, we use the term execution in place of p-execution. 

We define the sample space S7 to be the set of all executions: S7 = {uj; uj execution}. 
We endow S7 with its discrete u-field Q = 2°. 

We now define various random variable on (0,£/). Throughout, random variables 
are denoted by upper-case and their realizations by lower-case. For all t, 1 < 
t < p, S t and F t are defined by St(oj) = s t , and F t (u) = f t . This allows us to 
define the derived random variables S t = (Si, . . . , St), J~ t = (Fi, . . ., F t ) and £ t = 
(Si, Fi, . . . , F t -i, S t ). S t , Tt, and £ t are respectively the random ^-schedule, the 
random i-fault sequence and the random i-odd-execution produced up to time t. 

We also let Q t = a ( Si , Fi , . . . , S t , F t ) and Q[ = a ( Si , Fi , . . . , S t+ i j be the u-fields 
of events "happening no later" then the selection of f t and s t+1 , respectively. 

We now define protocols and adversaries. As recalled in the previous section, the 
protocols and the adversaries are the strategies of Player(l) and Player(2) taking 
random steps in turn and sending information to the other player at the end of each 
step. The probability distribution used for this step depends on the view of the 
system held by the player. In our specific problem, Player(2) is informed of all the 
moves of Player(l), (but nothing else about the protocol it selected by Player(l)), 
whereas Player(l) learns nothing from and about Player(2). We adopt the local 
point of view to describe an adversary and the global point of view to describe a 
protocol. 6 

Hence, an adversary A is a family of probability distributions (Q v ) ve v on [p] 5 one 
for each t, 1 < t < p and each i-odd-execution v = (s l7 / l5 . . . , ft-i, s t ) and such 



3 See page 139 for a definition of the local and of the global point of views. 
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that, with (^-probability one, (/ l5 . . . , f t ) is adapted to (s l7 . . . , s t ). 

A scheduling protocol it is a probability distribution on V n {p) p . 

As is established in Section 2.4, there is a unique and well defined probability dis- 
tribution P Wt A induced on the set of executions by a given protocol it and a given 
adversary A. For the sake of illustration, we give an explicit characterization of P WtA 
in the next proposition. 

Proposition 7.2.1 Let it and A = (Q v )vev be a protocol and an adversary as 
defined above. Then there is a unique and well defined probability distribution P WtA 
on (Q,G) satisfying the following two properties: 



i P*,a\ S p = 'J = 7r - 



ii For every t, 1 < t < p, every t-execution v = (s l7 / l5 . . . , fi-i, s t ), and every 
(p-t)-schedule (s t+1 , ...,s p ) such that ir(s 1 , . . . , s p ) > and Q Sl (/i)<5 Sl/lS2 (/ 2 ) 
Q Sl fiS2-st-i(ft-i) > 0, we have: 



PjT,A \Ft — ' | £t — V 7 {^t + l, • • • 1 <->p) — ( S t + 1? • • • 1 S p)\ — Qv ■ 

Property i formalizes the fact that the protocol receives no on-line information 
and makes its decisions in isolation. Property ii formalizes the fact that the ad- 
versary is on-line and selects F t based on the sole knowledge of the past odd- 
execution S t , independently of the schedule (St+i, ■ ■ ■ , S p ) selected for subsequent 
times. Using Convention 8.1.1 we extend the definition of the conditional probabil- 
ity in ii and set P W>A \F t = • S t = v, (S t+1 , ...,S P ) = (s t+1 , ..., s p )J = whenever 

Q Sl {h)Q s 1 f lS2 (f2)Q «i/i« 2 ...«t_i(/t-i) = o. 

Proof. Let uj = (si, fi,s 2 , f 2 , ■ ■ -,s p ,f p ) be a generic execution in S7 and, for 
every t, let uj t = («i, f\, ■ ■ ■ , s t ) be the associated i-odd-execution. By successive 
conditioning we can write 

Pn,A(u) = Pk,a[S p = Oi,...,S p )J P n ,A[Fl = /l | £l = U 1 ,S 2lP = (s 2 ,...,S p )J ... 
• • • Pit, A \Fp- 1 = Jp- 1 | S p - 1 = CJp-i, S p = S p \ P Wi A \Fp = Jp £p = w p 



so that we see that the conditions i and ii imply that, if it exists, P w ^(u) must be 

equal to 

p 

P^A^) = 7r [(s 1 ,...,Sp)]Y[Q Wt (ft) ■ 
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We easily check that P Wy ^ thus defined is additive and that P^^O) = 1. As Q is 
finite, the u-additivity of P w ^ holds trivially. Hence P Wy ^ is a well defined probability 
measure. □ 

We have therefore defined the family of probability distributions (Pr^)^^ on the 
same space (0, £/). In situations different from our scheduling problem, such a 
modeling is in general not possible and a different probability space (i\^, Gw,a) 
must be associated to each couple (it, A). Also, in the case of infinite executions, 
the construction of a measure P Wy ^ is a non-trivial probability problem requiring the 
use of an extension theorem (e.g., Kolmogorov's extension theorem). We presented 
the general construction in Section 2.4 of Chapter 2 when the the coins of both 
players have at most count ably many outcomes. 

We can now set up formally the optimization problem presented in Section 7.1. 
The survival time is defined to be the random variable T = max{i; \/u < t, \S U fl 
{Pi, . . .,P,}| < m}. For every protocol 7r, let t(ir) = inf^ E W ^[T] be the worst case 
performance of it. We let 

t opt = supt(Tr) = supinf E WtA [T] . 

■K IT A 
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7.3 Some Specific Probability Results 

7.3.1 A formal interpretation of the on-line knowledge of the ad- 
versary 

We begin this section by presenting a lemma expressing that, for every protocol and 
every adversary, conditioned on the past, the selection F t made by the adversary at 
time t is independent of the choices S t+ i, . . . , S p made for ensuing times by the pro- 
tocol. This shows that the definitions of a protocol and of an adversary given in the 
previous section formalize accurately the on-line nature of the information received 
by the adversary: eventhough a protocol decides the whole schedule Si,...,s p at 
the beginning of the execution, the adversary does not get to see each decision s t 
before time t. (As mentioned in Section 7.1.2, Page 139, a more correct statement 
is "the adversary-designer does not get to see each decision s t before time i".) 

Lemma 7.3.1 Let it be a protocol, A be an adversary, t,t < p— 1, be a time and v 
be a t- odd- execution such that P^^Et = v] > 0. Then the random variables F t and 
(5( + i )P are independent with respect to the measure P Wt A when conditioned on £ t = v. 

Proof. This is a direct consequence of Proposition 7.2.1: by Condition bf ii, for 
every p—(t + l)-schedule a, for all v and a, 

Pn,A [F t = ■ \ E t = v, S t+liP = a J = P n>A [ F t = ■ | E t = v J . 

This expresses exactly the independence of F t and S t +i iV conditioned on £ t = v. □ 

7.3.2 The Notations P v and P A 

The next two definitions Definition 7.3.1 and Definition 7.3.2 introduce the family 
of protocols that select with non-zero probability a given ^-schedule, and the family 
of adversaries that select with non-zero probability a given i-fault sequence. The as- 
sociated lemmas, Lemma 7.3.2 and Lemma 7.3.3 introduce and justify the notations 
P w and Pj(. These two lemmas will be fundamental in our proofs for the following 
reasons. We will introduce one (family of) algorithm 7r and an adversary Aq. In 
one part of the proof we will establish that 7r is optimal against Aq. Throughout 
this part we will consider only the adversary Aq. Lemma 7.3.2 will allow us to 
consider the unique expression P Ao instead of the family (P 7r) ^ ) 7re n- This will make 
the analysis much simpler as the optimization over it will not involve the probability 
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measure. Symmetrically, in the second part of the proof we will in essence estab- 
lish that Ao is optimal against 7r . In this part we will need to consider only the 
expression P Wo instead of the family (Pk ,a)az.a- 

Definition 7.3.1 Let (s l7 . . .,s t ) be some t-schedule. Then 

Pgenerating(s 1 , . . . ,s t ) = J7r; 3(s t+1 , . . ., s p ), tt[(s 1 , . . . ,s p )] > OJ . 

As just mentioned, the next Lemma provides the fundamental technical tool that will 
allow us to handle conveniently all the probabilistic expressions required in the proof 
of Lemma 7.4.7 - the proof that 7r is optimal against Ao- 7 Similarly, Lemma 7.3.3 
will provide the probabilistic tool required in the proof of Lemma 7.4.8 - the proof 
that Ao is optimal against 7r . 

Lemma 7.3.2 Let t, 1 < t < N and let a = (si , . . . , s t ) be a t-schedule. Let $ £ Q t . 
Then, for every adversary A, 

P*,A [$ I S t = a] 
is independent of the protocol it £ P generating (^a). We let 

Pa [$\S t = a] 
denote this common value. 

Following Convention 8.1.1, P Wt A [^ I S t = cr] is set to zero if it g - P generating {a). 

Proof. Let it be any protocol in Pgenerating(a) and let A = (Q v )vev be a given 
adversary. Recall that, by definition, (see page 141), Q t = cr(Si, Fi, . . . , St, Ft). 
Thus, an event $ is in Q t if and only if there exists a boolean random variable (f> 
depending on uj only through the random variables (Si, Fi, . . .,S t , F t ), (i.e., (f>(u) = 
ip(Si(oj), . . ., Ft(uj)) for some real random variable ip), such that $ = {uj ; (f>(u) = l}. 
We have: 

P*,A [<S>\St = a] 
= E n>A y>\S t = ctJ 

Both 7To and Ao are defined in Section 7.4. 
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E P ^[ F l = A I ^ = ^ E P ^[ F 2 = h I S t = <7,F 1 = h] ... 

' "l h 

■■■J2 P «^[ Fi = ft\St = °, F 1 = /i,...,Fi_i = /i_i] J i>(s u f u ...,s t ,f t 



St 

= X)Q.i[/l] X)Q.i,/i,. a [/2]---X)^»i./i.-.»«[/*] Hsufl, •••■>*, ft) ■ 
/l /a /< 

This last expression is independent of the protocol it, as needed. □ 

The following definition describes the set of adversaries that generate with non zero 
probability a given fault sequence. Note that, by Lemma 7.3.2, Pj\J~t = § I &t = &] 
is itself well-defined. 

Definition 7.3.2 Let a be a t-schedule, and (f> a t -fault sequence adapted to a. Then 

Agenerating a ((f)) = <A; PaI^ = (f> \ S t = <j] > 0> . 

Lemma 7.3.3 Let t, 1 < t < p, let a be a t-schedule, (f> be a t-fault sequence adapted 
to a and Let $ be an event in Q' t . Then, for every protocol it £ P generating (a) , the 
expression 

is independent of the adversary A G Agenerating a (<f)). We let P w [& \ S t = a,Tt = (f>] 
denote this common value. 

Proof. The proof closely follows that of Lemma 7.3.2. We write a = (s l7 . . . , s t ) 
and (f> = (fi, . . . , f t ). By assumption, there exists a boolean random variable (f> de- 
pending on oj only through the random variables (Si, Fi, . . .,S t , F t , <5t+i), (i.e., <j>(oj) = 
ip(Si, Fi, . . . , S t , F t , St + i)(uj)) for some real random variable ip), such that <I> = 
{uj ; (J)(oj) = 1}. Let it be a protocol in P generating (a) and A = (Q v )vev be 
an adversary in Agenerating „((f>). We let P w [S t +i = s t+ i \ S t = cr] denote the con- 
ditional probability (J2 a ^K* 7 *? s t+i? a )])/(Xa' 7r[(o"t, a ')]) where the first summation 
is over all p — (t + l)-schedules a and the second over all p — ^-schedules a'. Then: 

= E niA [c/) | S t = <j,T % = 4>] 

= ^2 p A s t+i = s t+i \S t = a] ip(s 1 ,f 1 ,...,st,ft,st +1 ) . 

St + l 

This last expression is independent of the adversary A used and this concludes the 
proof. □ 
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Lemma 7.3.4 Let t be a time, 1 < t < p. Let a be a t-schedule and A be an adver- 
sary. Then P^[ • | S t = cr] is a probability distribution on (£l,Q t ). Similarly, if a is 
a t-schedule, (f> a t-fault sequence adapted to a and it a protocol in P generating (^a), 
then P w [ ■ | S t = cr, Ti = (f>] is a probability distribution on (£l,Q' t ). 

Proof. P^[ • | S t = cr] is defined on (£l,Q t ) to be equal to P Wt A[ ■ I St = a ] f° r 
any it £ P generating (^a) and is therefore a well defined probability distribution (on 
(0,£/i)). Similarly, P w [ ■ \ S t = cr, T t = (f>] is defined on (0,^) to be equal to 
Pw,a[ ' \ St = cr, J- t = 4>] for any A G Agenerating a (cj)) and hence is a well defined 
probability distribution on (0,^). D 

Note: In spite of its apparent simplicity, Lemma 7.3.2 answers a subtle point il- 
lustrating the difference between implicit and explicit knowledge that we quickly 
recall. 8 

In order to compute the optimal survival time t opt = sup n mf ^ E W ^[T] we are led 
to consider the performance values t(ir) = inf^E^-^fT] associated to all protocols 
it. In the previous formula the infimum is taken over all adversaries for a given 
it. A common interpretation of this fact is that the optimal adversary "knows" 
the protocol: this consideration entitled us to assume an off-line adversary in the 
deterministic case. Hence, such an adversary is provided with: 

• the on-line information of the past schedule. At every time t, we can picture 
that an explicit message is relayed to the adversary to inform it of the set s t 
last selected by the protocol. 

• the off-line information of the protocol it that A is associated with: this infor- 
mation is implicitly provided to an optimal adversary. 

These two notions of knowledge are very different, and Lemma 7.3.2 would not hold 
if we assumed that the adversary was provided with the explicit knowledge of it 
and was able to use this information in the selection of the elements Fi, . . . ,F p . 
For instance, consider the case where p = 3,ra = 2 and m = 1. Consider a greedy 
adversary A, selecting at each time t a processor F t so as to maximize the probability 
that F t is in ^+1. Assume that Si = {1,2}. Consider two different protocols Xi and 
7r 2 . Assume that protocol Xi always selects s 2 = {1,3} whereas 7r 2 always selects 
s 2 = {2,3}. If A knows the protocol it is associated with, A selects i<\ = 1 with 
probability one when associated with Xi , and selects Fi = 2 with probability one 



These notions are presented in Page 207. 
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when associated with 7r 2 . Hence, in this case, the probability 

^r,^ [^1 = 1 | ^1 = il,2>] 

is not independent of the protocol it considered, even though the event {i<\ = 1} is 
clearly in the u-field Q x - 

Hence Lemma 7.3.2 would not be true, had we assumed, as in [25], that the ad- 
versary "knew" the protocol. Recall that, as is argued in Page 131, this change of 
model only affects the way the adversary is defined and interacts with the proto- 
col. In particular, it does not affect the class of optimal protocols. Nevertheless, as 
Lemma 7.3.2 is crucial for the proofs given in Section 7.6, our proof of optimality 
would not carry over in the Strong Byzantine setting. 

7.3.3 Applications of the definition of Pj, and of P w 

Lemma 7.3.5 For all j and t, j < t, all t-schedules a and all adversaries A, 
Pj( [Fj G • | St = a\ and P^ [T > t | S t = cr] are well defined probabilities. 
Similarly, if a is a t-schedule in Af t , 4> a t -fault- sequence adapted to a and it a 
protocol in P generating {a), then P W [P > t + 1 | S t = o, T t = <j)\ is a well defined 
probability. 

Proof. The random variable Fj is clearly ^-measurable for all j, 1 < j ' < t (by 
definition of Q^)- Hence the first result is a simple application of Lemma 7.3.2. On 
the other hand we can write 

t 

{P>t} = D{\S j n{F 1 ,...,F j }\<m} 

i=i 
t 

= n{i^ n {^---'^-i}i< TO - 1 }- 

i=i 

For all j, the event {1^- P\ {Fi, . . .,i*}_i}| < m — 1} is clearly in Q'j_ 1 C Q' t _ l C Q t . 
Hence {T > t} is also in Q t and Lemma 7.3.2 again shows that Pj(\P >t | S t = cr] 
is a well defined probability. Similarly {T > t-\- 1} is in Q' t so that, by Lemma 7.3.3, 
P-k [ T > t + 1 | St = (7, J~ t = <j) ] i s a wei l defined probability. □ 

The following lemma expresses that, conditioned on S t -i = cr, the events S t = s 
and T > t — 1 are independent with respect to the measure P4 (i.e. with respect to 
any measure P w a)- 
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Lemma 7.3.6 For every t, 2 < t < N , every t — 1-schedule a and every s G V n {p), 
P A [T > t - 1 | S t = {a, s)] = P A [T > t - 1 | 5 t _! = a] . 

Proof. Note first that, by Lemma 7.3.5, the quantities involved in the previous 
equality are well defined. 

P A [T>t-l\St- 1 = <J,S t = s] 

t-i 
= Pa[ f]{S u n{F 1 ,...,F u _ 1 } = (&} I St- 1 = a,S t = s] 

t-i 
= Pa[ n{^n{F 1 ,...,F u _ 1 } = 0} I S t - 1 = a,S t = s]. 
u=i 

By Lemma 7.3.1, conditioned on S t -i = cr, the random variables (_F l7 . . . , F t -\) 
and S t are independent. Hence, conditioned on S t -i = (J, the events P\ t u Z} 1 {s u n 
{-Fi, . . .,F u _i} = 0} and {St = s} are similarly independent so that 



i— i 

Pa[ n{^n{F 1 ,...,F u _ 1 } = 0} 



S t -i = a, S t 



tl=l 

t-1 



= Pa[ f]{s u n{F 1 ,...,F u _ 1 } = (&} I S t - 1 = a] . 
u=i 

This establishes our claim. □ 

The following definition characterizes the schedules a which allow the system to 
survive with non-zero probability. 

Definition 7.3.3 Let a be a t-schedule such that sup^ P^ t A \St = v^T >t\ > 0. We 
then say that a is an .4-feasible t-schedule and we denote this by: 

a G Feas A . 
Remarks: 

1. Using Convention 8.1.1 we see that a G Feas^ if and only if sup^ P W ^[T > t \ 
S t = a] > i.e., if P A [F > t \ S t = a] > . 

2. We will provide in Corollary (7.6.2) a pure combinatorial characterization of 
Feas^ for the adversary Aq defined in Definition 7.4.1, page 163. 
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7.4 Description of a Randomized Scheduling Algorithm 

For the rest of this chapter we restrict ourselves to the case m = 1, i.e., when the 
system can sustain one fault but crashes as soon as at least two of the n processes 
are faulty. We provide a family of protocols and prove their optimality. 



7.4.1 Description of the program 

We formally defined a protocol to be a probability distribution on V n (p) v . In place of 
a single protocol 7r we present here a family Prog of programs not only outputting 
random schedules (Si, . . ., S p ) in V n (p) v but making also other, internal, random 
draws. For the sake of clarity we distinguish between a program and the protocol 
associated to it, i.e., between a program and the probability distribution of the 
random schedule (Si, . . . , S p ) that it generates. For every program prog in Prog we 
let vr prog denote the associated protocol. We also let Prot(Prog ) denote the family 
of protocols derived from Prog : 

Prot(Prog ) = {vr prog ; prog £ Prog }. 

In the code describing Prog we use statements of the kind X := unif orm(a; A) and 
X := arbitrary(a; A). We call these statements randomized invocations. For 
every set A and integer a, a < \A\, the statement X := unif orm(a; A) means that 
the set X is chosen uniformly at random from V a (A) i.e., from among all subsets of 
A of size a. Similarly, for every set A and integer a, a < \A\, the statement X : = 
arbitrary(a; A) means that the set X is chosen at random - but not necessarily 
uniformly - from V a (A). The probability distribution used for this random selection 
is arbitrary and depends on the values returned on the past previous randomized 
invocations done by the program. This means that, for every t, the probability 
distribution used for the t + 1-st invocation can be written P ri) ri , where r\, . . . , r t 
are the t values returned by the first t randomized invocations. 

Prog represents a family of programs, one for each choice of the probability distribu- 
tions Pn,...,rt used at all the randomized invocations. (Recall though, by definition, 
if the t + 1-st randomized invocation is X := unif orm(a; A) then P riy ... yrt = U-pjA) 
for all r\, . . .,r t .) We will not make these choices explicit and will show that all 
programs prog in Prog are optimal. 

We present the code describing Prog in the next figure and provide explanations 
after it. 
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Prog 



Variables: 

C C [p]; initially \p] 

Cj C [p], j = 1, . . . , p; initially arbitrary 

5j G V n {p), j = 1, . . .,p; initially arbitrary 

S G V n (p); initially arbitrary 

I-, I' i J ^ Mi initially arbitrary 

ii G [p]; initially arbitrary 

«GN; initially n 



Code 


: 




01. 


for t 


= 1,..., [p/n\ do : 


02. 


s t 


:= arbitrary(ra; C ) 


03. 


Co 


:= Co — Jt 


04. 


c\ 


:=S t 


05. 


for t 


= [p/n\ +l,...,p-ra + l ( 


06. 


iit = [p/n\ + 1 then : 


07. 




St '■— Co 


08. 




C o :=0 


09. 


€ 


;lse S t :=<H 


10. 


if 


LfrJ < « then : 


11. 




« : = Lf5rJ 


12. 




/ := arbitrary(p — n — |_f- 


13. 




J := I- V --[t-l]-I 


14. 




while / ^ do : 


15. 




ii' := arbitrary(l; /) 


16. 




5 := unif orm(a + 1; C'k 


17. 




S t := S t U (C* - S) 


18. 




C'k '■= S 


19. 




I:=I-{K} 


20. 




while /' ^ do : 


21. 




K := arbitrary(l; I') 


22. 




S := unif orm(a; C'k) 


23. 




S t := £ U (C K - S) 



i);[*-i]) 
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24. 


C'k '■— S 




25. 


I' := /' - {K} 




26. 


Ct := bt 




27. 


if LffrJ = a then : 




28. 


b := unif orm(a + 1; C t -i) 




29. 


bt := W-l — b 




30. 


Ct-l '■= b 




31. 


F := arbitrary(a + 1; J U {t - 


"I}) 


32. 


J:=(JU{t- i})-r 




33. 


while /' ^ do : 




34. 


K := arbitrary(l; I') 




35. 


b := unif orm(a; Ck) 




36. 


b t := 5 t U (C K - S) 




37. 


Ck '■= S 




38. 


V := /' - {K} 




39. 


Ct '■= b t 





7.4.2 A presentation of the ideas underlying Prog 

We begin by presenting the purpose of the program variables used in Prog . At the 
end of each round t: 

1. St is the set of n elements selected by the protocol for round t. 

2. C represents the set of elements of [p] that have not been used in the first t 
rounds. 

3. For every j, 1 < j ' < t, Cj is the set of elements selected at time j - i.e., elements 
in Sj - and which have never been used in later rounds j + 1, j + 2, . . . ,t - 
i.e., which are in the complement (Sj + i U . . . U St) c of Sj + i U...U5(. 

For reasons presented below, at the end of each round t,t > |_~J + 1, an d for every 
j, 1 < j < t — 1, Cj is either of size LfzrJ or °^ slze Lfrf"J + 1- To achieve this, at 
each round t, t > [^\ +1, the program variable a is re-initialized to this value L7Z7J • 
The program variables /, I' and J are used to distinguish and manipulate the two 
sets {j G [1,2 — 1]; \Cj\ = a} and {j G [1,2 — 1]; \Cj\ = a + 1}. The program variable 
K is used to make some non-deterministic choices in the course of the execution. 
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The following explanations will explain the code and bring some intuition behind 
the choice of these numbers. 



The idea of the code is to select for each round t the set St in a greedy fashion so 
as to optimize the probability of surviving one more round, if faulty processors are 
selected uniformly at random. For each t < [-\ , the set C of fresh elements has 
size at least n at the beginning of round t and it is therefore possible to select St 
as a subset of C . This is accomplished in lines 01 through 04 of the code. As only 
so far unselected elements are selected at each round t, we have Cj = Sj for every 

i<i<*<L£J- 

In round |_-J + 1 the set C is possibly non-empty at the beginning of the round, but 
holds less then n elements. We select all its elements and allocate them to ^.lj+i. 
This is done in lines 06 through 08 of the code. From that point on, i.e., for the 
completion of the selection of the set SyiL\ + i as well as for the selection of later sets 
St, we have to select elements that have been selected previously at least once. We 
adopt the following simple strategy: we select elements from the sets Cj,\ < j < t, 
that have the biggest size until n elements have been selected. For every j, 1 < j ' < t, 
by definition of Cj - as the set of elements selected in round j but never selected 
afterwards - every element of Cj selected in round t must be removed from Cj during 
this same round. Hence the strategy consists in transferring into St n elements from 
the sets Cj that have the biggest size. Once this transfer is accomplished St is of 
size n and we initialize C\ to be equal to Sf 

At the point in round |_-J + 1 when C becomes finally empty, (in line 08), and when 
the transfer strategy begins to be implemented, the sets C\, . . . , Cyx.^ are all of size 
n. We can picture transferring elements away from sets Cj of biggest size as the 
selective flow of resources away from big reservoirs: by doing so we maintain to parity 
the level of all the reservoirs. In our case, as we are transferring discrete elements in 
place of a fluid, the transfer strategy keeps the size of the sets Cj different by at most 
one. Another consequence of the fact that elements are transferred from the sets Cj 
into S t is that, at the end of each round t,t > |_~J + 1, the sets C\, . . . , C t -\, S t are a 
partition of the set [p] of all elements. Hence we are in a situation where p elements 
are partitioned into t sets: on the one hand, a set St of n elements and, on the other 
hand, t — 1 sets whose size differ by at most one. A computation (see Lemma 7.4.3) 
shows that these sets must be either of size |_7zf"J or °f s i ze l_frf"J + 1 an( i that the 
number of sets of size [jz^\-r^- '^ p — n— [j^-\(t — l). The idea in the code is to use 
these numbers and modify for every round t the sets C\, . . . , C t _ 2 , <$*_! determined 
at the end of each round t — 1 to produce the partition C\, . . . , C t -i, S t that must 
result in round t. 
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By our previous argument, at the end of each round t — 1, the sets C\, . . . , C t _ 2 are 
all of size at least |_fzf"J an( i $t-i = C*-i i s °f s i ze ra - At the end of each round t, 
these t — 1 sets must be modified and reduced to size \_jz^\ or |_7zf"J + 1- We need 
to distinguish two cases according to whether [fz^J i s ^ ess or equal to [frfj • I 11 
the first case the code branches according to line 10, and lines 11 through 26 are 
followed. In the second case the code branches according to line 27, and lines 28 
through 39 are followed. 

Consider the case where [jzj\ ^ LfrfJ • ^ n this case, every set Cj, 1 < j < t — 1, 
existing at the end of round i — 1 is of size at least |_frf"J > LfrTJ + 1 an< ^ nence i s big 
enough to be reduced to either one of the two allowable sizes (LttjJ or LfrrJ ~^ ^) 
at the end of round t. Consider now the case where |_7zf"J = LfrfJ • ^ n this case the 
sets Cj, 1 < j < t — 1, which are of the smaller size \_jz^\ at the end of round t — 1 
cannot be reduced to the size [jzj\ + 1 (= LfrfJ + 1) m the next round: only sets 
being of the bigger size [jz^\ + 1 at the end of round t — 1 can give rise to sets of 
the bigger size LfzyJ + 1 a ^ the end of round t. 

In the first case, we branch according to line 10 and select in line 12 an arbitrary 
subset / of {1, . . . , t — 1} of size p — n — [frf - ] (t — 1) : this set is the set of indices 
describing which of the sets C\, . . . , C t -i will be the bigger sets at the end of round 
t. We keep in the variable J a record of this selection (see line 13). Then, in lines 15 
through 19 and 21 through 25 we transfer elements from the sets Cj into St, leaving 
the sets Cj, 1 < j < t — 1, in their pre-decided size. We finally initialize C\ to the 
value St once the selection of St is finished (see line 26). Let us emphasize that, at 
the end of the round, J records the identity of the bigger sets Cj. 

In the second case we branch according to line 27. In this case, at the beginning of 
round t, the sets C\, . . . , C t _ 2 are all of one of the two sizes [jzj\ + 1 an< ^ Lf~fJ ' an< ^ 
J records the identity of the bigger sets Cj, 1 < j < t — 2. Also, at this point, C t -i 
is of size n. As all the sets C\, . . . , C t -i must be reduced to size at most LfrrJ + 1? 
we first transfer n — (LfrjJ + 1) elements from C t -i to S t (see lines 28 through 30). 
We finish the selection of S t by selecting one element from each of |_7T~rJ +1 se ^ s 
arbitrarily selected from J U {t — 1}. (The selection of the L^ztJ + 1 se ^ s 1S done 
in line 31. The transfer of the elements is done in lines 34 through 38.) As in the 
previous case, we update J so as to record the identity of the bigger sets Cj at the 
end of the round (see line 32) and initialize C\ with the value St (see line 39). 
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We quickly discuss the choice of the probability distributions used in Prog . As 
mentioned at the very beginning of our explanations, the idea of the code is to select 
for each round t the set St in a greedy fashion so as to optimize the probability of 
surviving one more round, if faulty processors are selected uniformly at random. 
Let us call random adversary the adversary that selects the faulty processors in 
this fashion. The main idea of the proof will be to prove that any it in Prog is 
optimal against the random adversary and then to prove that, against any such 
7r, no adversary can do better then the random adversary. As we will see, we 
could replace all the uniform randomized invocations by arbitrary randomized 
invocations and still obtain optimal protocols against the random adversary. The 
reason is, (as we will see), that for every time t, the fact that the system is still 
alive after the occurrence of the i-th fault means exactly that, for every j,j<t—l, 
the j'-th fault is in the set Cj. (This is where the condition m = 1 plays its role.) 
Furthermore, if the system is still alive after the occurrence of the i-th fault and if 
the adversary is the random adversary, all the elements of Cj are equally likely to be 
faulty. This is due to the nature of the random adversary which, by definition, makes 
its selections irrespectively of the identity of the elements chosen by the protocol. 
Hence, for every N , if in round t + 1 the protocol is to select a given number N of 
elements from one of the sets Cj, all the ( ^ ) choices are equally as good, as any 
N elements of Cj have the same probability of all being not faulty. 

But this does not hold for a general adversary. In effect, a general adversary can 
differentiate between different elements of a given Cj when the protocol uses arbi- 
trary distributions to make such selections. We show that the strategy according 
to which, whenever selecting elements from a given set Cj, the protocol always uses 
the uniform distribution, disallows the adversary such capabilities of differentiation. 
This means that the use of uniform randomized invocations reduces the power of 
any adversary to the one of the random adversary. 

We use arbitrary randomized invocations to emphasize that for the other random- 
ized invocations made by the protocol, the choice of the distribution is irrelevant 
for the effectiveness of the protocol. For the simplicity of the exposition we let the 
protocol make these choices. But we could easily extend our results and prove that 
the programs in Prog would perform equally well if these choices were made by the 
adversary. 
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7.4.3 Invariants 

For t = 1, . . . , [p/n\ and for every execution of a program in Prog , we define round 
t to be the part of the execution corresponding to the i-th loop, between line 02 
and line 04 of the program. Similarly, for t = [p/n\ , . . . ,p — n + 1 and for every 
execution of a program in Prog , we define round t to be the part of the execution 
corresponding to the i-th loop, between line 06 and line 39 of the program. 

Lemma 7.4.1 Prog satisfies the following invariants and properties valid at the 
end of every round t, 1 < t < n — p+ 1. 

a. All invocations in round t of the commands arbitrary or uniform are licit, 

i.e., a < \A\ for every invocation of arbitrary(a; A) and o/unif orm(a; A). 

b. a is equal to n if t < |_^J and equal to [jzj\ tf ln\ A^1^t<p — n+1. 

c. I^d = n. 

d. For every j, 1 < j < t, Cj = Sj fl (Sj + i U . . . U St) c . In particular C\ = S t . 

e. c = (u t j=1 s j y = (u t j=1 c j y. 

f . C , C\ , . . . , C\ form a partition of [p] . 

g- Ifl<t< [ P ~\ then\C\\ = ...= \C t \ = n. 

h. // L^-J + 1 < t < p - n + 1 then 

1. Co = 

2-i. For every j, 1 < j < t - 1, \C)\ is equal to [^-\ or [^-\ + 1 

2-ii. There exists j, 1 < j < t — 1, such that \Cj\ = [jz^\ ■ 

3. \C't\ is equal to n. 

i. // [ £ J + 1 < t < p - n + 1 then J = {i G [t - 1]; |C| = a + 1} and \J\ = 

P-n-l^Kt-1). 

Proof. For every program variable X, we let X(t) denote the value held by X 
at the end of round t. We extend this definition to t = and let X(0) denote the 
initial value of any program variable X . 

We easily see that, for every t, the program variable St is changed only in round t. 
Hence St(t) = St(t + 1) = . . . = S t {n — p + 1) so that we can abuse language and let 
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St also denote the value St(t) held by the program variable St at the end of round t. 
(We will make explicit when St refers to the program variable and not to the value 

St(t).) 



Invariant b. For every round t, 1 < t < [p/n\ , the program variable a is left 
unchanged: a(t) = a(0) = n. For every t, [p/n\ + 1 < t < p — ra+1, the program 
variable a is left unchanged if equal to \_jz^\ and reset to this value otherwise. (See 
lines 10, 11 and 27). Hence a(t) = \_jz^\ ■ This establishes invariant b. We prove 
the other invariants by induction on the round number t. 

Case A. Consider first the case < t < I -I. In this case we furthermore establish 
that Si, . . . , S t are all disjoint, that Cj(t) = Sj for every j, 1 < j ' < t < |_-J and that 
C (t) is a set of size p — tn. This is true for t = as C (0) = [p] and as, in this case, 
the family Si , . . . , St is empty. Assume that all the invariants are true for some round 
t — 1, < t — 1 < |_-J- Consider round t. In line 02 of the program, C has value 
C (t — 1), which is of size p—(t— l)ra, by induction. As t — 1 < |_~J , P — (t — l)n > n 
and hence the invocation S t := arbitrary(ra; C ) is licit: invariant a is satisfied 
for round t. Hence St is a well-defined set of size n and invariant c is satisfied for 
round t. As St is a subset of C (t), invariant e (for t — 1) shows that St is disjoint 
from U* -1 ^' so that Si, . . ., S t are all disjoint. In lines 02-04 the program variables 
Cj, 1 < J ' < t — 1 are not changed. Hence Cj(t) = Cj(t — 1) = Sj, 1 < j ' < i — 1. On 
the other hand, by line 04, C't(t) = S t , and by line 03, C (t — 1) is the disjoint union 
of C (t) and of S t . Hence |C (i)| = \C (t - 1)| - |5 t | = (p - (t - l)n) - n = p - tn. 
From these properties we easily check that the invariants d, e, f and g are true for 
t. 



Case B. We now turn to the case [p/n\ + 1 < t < p — ra + 1. Assume that t is such 
an integer and such that all the invariants are true for t — 1. 

Case B-I. Assume [jz^\ < a in line 10 is true. 

We first establish that t = [p/n\ + 1 falls in case B-I. We just proved that all the 
invariants a, . . ., g hold for t — 1 = [p/n\. By Lemma 7.4.2, [frrJ < n - O n the 
other hand, in line 10, the program variable a has value a(t— 1) = a(0) = n. Hence 
the precondition |_7rf"J < a m une 12 is true for t = [p/n\ + 1. 

Invariant a. We easily check that for every t, < p — n — [jzr[\(t — 1) < t — 1. 
(For every numbers x and y, x — \xjy\y is the rest of the Euclidean division of x 
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by y.) Hence the invocation / := arbitrary(p — n — [jzj\ (^ ~ 1)> [^ — 1]) °f ^ ne 12 
is always licit (for t = [p/n\ + 1, . . . ,p — n + 1). 

In line 17 and in line 23 the program variable C'k has value Cxit — 1), a set of size 
a(t — 1) or a(t — 1) + 1 by invariant b and h for t — 1. Recall that, by assumption, 
the precondition of line 10 is true: a(t) < a(t — 1) i.e., a(t) + 1 < a(t — 1). This 
implies that the invocations S := unif orm(a + 1; C'k) and S := unif orm(a; C'k) of 
respectively lines 16 and 22 are licit. This shows that the invariant a is true for t. 

Invariant h-1. The variable C is set to in round [p/n\ + 1 and never altered 
afterwards so that C (t) = for t = [p/n\ + 1, . . .,p — n + 1. This establishes 
invariant h-1. 

Invariants d, e and f. By assumption, (invariant f for t—1), C (t—1), . . ., C t -i{t — 1) 
is a partition of [p]. The set St is obtained by first taking all the elements of C (t—1), 
(which is non-empty only if t = [p/n\ + 1), and then, in lines 16, 17, 18 and 22, 
23, 24, transferring some subsets of C (t — 1), . . . ,Cj_i(i — 1) into Sf Hence, by 
construction, the sets C\(t), . . .,C't-i(t) and St are a partition of [p] i.e., invariant 
f is true. This implies also that Cj(t) = Cj(t — 1) — S t = Cj(t — 1) fl S^ for every 
j, 1 < j < t — 1. By invariant d for t — 1, we have Cj(t — 1) = 5j fl (6*1 U . . . U ^t-i) . 
Hence Cj(t) = Sj fl (Si U . . . U St) c for every j, 1 < j ' < t — 1. Furthermore, by line 
26, Ci(i) is equal to 5^. Hence invariant d holds for t. We also easily deduce e. 

Invariants i and h-2. By lines 16, 18 and 22, 24, for every j, 1 < j ' < t — 1, the 
quantity |Cj(i)| is equal to a(t) or a(t) + 1. This along with invariant b already 
proven shows that invariant i is true for t. Furthermore, the set of indices j, 1 < 
j < t — 1, such that Cj(t) is of size a(t) + 1 is the set / determined in line 12. 
(See lines 12 through 19 of the protocol.) This set is equal to the value allocated 
to J in line 13. As J is not further changed in round t this value is J(t). This 
establishes invariant h-2-i. As mentioned in the proof of invariant a, for every t, 
p — n — |_7ZT_|(^ — 1) < £ — 1- Hence the value allocated to / in line 12 is not the 
whole set [t — 1]. Consequently, at the end of line 13 I' is not equal to and for 
every k £ I' the while loop from line 20 to 25 produces a set C^{t) of size a(t), 
i.e., by invariant b, a set of size L^zrJ - This establishes invariant h-2-ii. 

Invariants c and h-3. Let b denote p — n — L7Z7J (t — 1) and let a denote t — 1 — b. 
Note that a > 0. We just established that the family C\(t), . . . , C't-i(t), S t is a par- 
tition of [p]. Therefore, C\(t), . . .,C't-i(t) is a partition of [p] — Sf By invariants 
h and i this partition is composed of b elements of size a(t) + 1 and of a elements 
of size a(t). Hence p — \St\ = q = aa(t) + b(a(t) + 1). On the other hand, by 
Lemma 7.4.3, p — n = aa(t) + b(a(t) + 1). This shows that 1^1 = n and hence, by 
line 26, that \C t (t)\ = n. 
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Case B-II. Assume [jzj\ < a in line 10 is false (i.e., [jzj\ = a in line 27 is true). 

Invariant a. In line 28, the value of the program variable C t -\ is C t -\{t — 1) which 
is of size n by invariant c and d for t — 1. As t > [p/n\ + 1, by Lemma 7.4.2, 
LfrrJ + 1 < ra which shows that the invocation S := unif orm(a + 1; C t -\) is licit. 

Note that, in line 27, a has value a(t — 1) so that the condition \_jz^\ = a of line 27 
exactly means that |_7Ti"J = a (t ~ !)• By invariant b, a(t — 1) is either n or [jz^\ ■ 
We prove that only the latter form arises in the equality |_frrJ = a (^ ~ -0 - R ecai l 
the two following facts established in the proof of invariant b given in page 157. 1) 
LfTnT-l ^ n ' ^) a ( [p/ n \ ) = n. From these two facts we deduce that the equality 
L^fyJ = a(t - 1) does not hold for t = [p/n\ + 1 as Ll^T^T-l < n = a {\j>l n \)- Hence 
equality in line 27 can occur only for t > [p/n\ + 1. By Lemma 7.4.2, t > [p/n\ + 1 
implies that [jzj\ < n and hence that a(t — 1) = LfrfJ- To summarize: equality 
holds in line 27 only for t > [p/n\ + 1 and then implies that [jzj\ = |_fzf"J • 

In line 31, the value of the program variable J is J(t — 1). By induction, (invariant i 
fori-1), J(i-l)isasubsetof [t-2] which is of size |J(i-l)| = p-n- [^f J(i-2). 
The element i — 1 is not in J(t — 1) (see invariant ifor t—1) so that \J(t— l)U{i— 1}| = 
\J(t— 1)| + 1. Recall that in line 31, the program variable a is equal to a(t) = \_jz^\ ■ 
We have: 



2) + 1 (by Lemma 7.4.4) 



a(t) + 1 
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This shows that the invocation I' := arbitrary(a + 1; J U {t — 1}) of line 31 is licit. 

Line 34 is within the while-loop originated in line 33. Each of the invocation 
K := arbitrary(l; J) of line 34 is licit as occurring while J is non-empty. 

In line 35, C'k is of size a(t — 1) + 1 because, by lines 31 and 34, K is an element of 
J(t— 1)U{£— 1} and because, by invariant i, K £ J(t— 1) implies that \Cxit— 1)| = 
a(t — 1) + 1 which is a(t) + 1 by line 27 - if K = t — 1, lines 28 and 30 show directly 
that \C'k\ = ot + 1. This shows that the invocation S := unif orm(a; C'k) in line 35 
is licit. 
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This finishes to establish that invariant a is true for t. 

Invariants c and h-3. In lines 28, 29, |C t _i| - (a{t - 1) + 1) = n - (a{t - 1) + 1) 
elements are allocated to S+. Let i 7 .. denote the value held by I' at the end of line 

1 mil */ 

31. In the while-loop (line 33 to 38), a(t — 1) + 1 additional elements are allocated 
to St. (a(t — 1) + 1 is the size of I' nit .) Hence a total of n elements are allocated to 
S t in round t. This shows that 1^1 = n and hence, by line 39, that |Ct(i)| = n. 

Invariants d, e, f, and h-1. As in the Case I, Cj(t) = Cj(t — 1) — S t for every 
j, 1 < j < t — 1, and C\, . . . , C't-i(t), S t is a partition of [p]. As in Case I, this implies 
that invariants d, e and f hold for t. The proof for invariant h-1 is also the same 
as in Case I. 

Invariant i and h-2. By invariant h-2 for t—1, for t—1, all the sets Cj(t — 2), 1 < 
j < t — 2, are of one of the two sizes a(t — 1) and a(t — 1) + 1, i.e., (recall that the 
condition of line 27 is true), of size a(t) or a(t) + 1. Also, by invariant i for t—1, 
J(t — 1) is the set of indices i,l < i < t — 2 for which C'i(t — 1) is of size a(t — 1) + 1 
i.e., of size a(t) + 1. At the end of line 30, the set of indices i,l < i < t—1 for which 
the value of C; is of size a(t) + 1 is the set J(t — 1) U {t — 1}. Let L' nit denote the value 
held by I' at the end of line 31. In the while-loop of line 33, (finishing in line 38), 
for every index k in L' nit , an element is transferred from C'k to Sf Hence, at the end 
of the while-loop all the sets d, 1 < i < t— 1 are of size a(t) or a(t)-\-l. This proves 
invariant h-2 for t. Furthermore, in the while-loop of line 33, the set of indices i 
for which the value of C; is of size a(t) + 1 is reduced to J(t — 1) U {t — 1} — L' nit . The 
value J(t — 1) U {£ — 1} — L' nit is the value J(t) given to J in line 32. (J is not altered 
further in round t and hence the value allocated to J on line 32 is the value J(t).) 
This establishes the first part of invariant i: J(t) = {i £ [t — 1]; |C;(i)| = a(t) + 1}. 

We compute |J(i)|. 



init I 



\.J(t)\ = 1^-1)1 + 1-^ 

= |J(i-l)| + l-( a (i) + l) 

= p — n — [jz^\ (t — 2) — a(t) (by invariant i for t—1) 

= p-n-[^\(t-2)- a(t) (because a(t) = [^\ = [^ j ) 

= p-n-[^\(t-l). 

This finishes the proof of invariant i for t. □ 

Lemma 7.4.2 Let t be a positive integer. Then [^t^J < n if and only ift> [p/n\ . 
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Proof. Write p = an + b with < b < n. Assume that t > [p/n\ . Then 

L^J < fej =(an + b- n)/a = n + (b - n)/a < n . 

We now prove that [1 < t < [p/n\ — 1] =>■ [^^J > n. If \_p/n\ = 1 the implication 
is trivially true. Assume that [p/n\ > 1. We have: 

l^\> [j^tJ = (an + b-n)/(a-l) = n + b/(a-l)>n. 

D 

Lemma 7.4.3 For every integers q and t the system of equations 

q = aa + b(a + 1) 
a -\- b = t 
a > 0,6> 

/jas exactly one integer-valued system of solutions: a = [j\, b = q — [j\t and 
a = t — b. 

Proof. Uniqueness: The equation q/t = (a/t)a + (b/t)(a + 1) shows that q/t 
is a convex combination of a and a + 1. Hence a must be equal to |_fj • Also, the 
equation q = (a + b)a + b = ta + b shows that b must be equal to q — 1 1_ jj . 

Existence: Write g/i as the convex combination of a = |_fj and of a+ 1 = |_fj + 1: 
q/t = ua + v(a + 1) with u-\-v = l. We have g/i = (u + f)a + f = a + f = |_fj + v. 
This shows that v is equal to q/t — |_fj and that u = 1 — v = 1 — q/t + |_fj • Hence 
we can chose b = vt = q — \_^\t and a = ut = (1 — v)i = t — b. □ 

Lemma 7.4.4 £e£ ra, p an<i i 6e £/iree positive integers such that n < p. Assume 
that L £^j = ^j . Then ^j < p _ n _ ^ J(/ _ 2 ). 

Proof. Obviously, <p-n- [^n.\(t-l) so that [^J <p-n- L^ErJ(* — 1 ) + 
L^J. By assumption, [^J = LfrfJ and hence LtztJ < P ~ n " Lfrf J(* " 2 )- D 

We now establish that, for every t, the quantity n,=i |Cj(OI 1S deterministic i.e., does 
not depend on the successive values returned by the randomized invocations arbitrary 
and uniform. This means in particular that, for every t, the quantity n,=i |Cj(OI 
is the same for all prog in Prog and does not depend on the values taken by the 
random variables S t , J\ , J 2 , • • • 
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Lemma 7.4.5 For every prog £ Prog , for every t,\ < t < p — n -\- 1, the prod- 
uc t n,=i |Cj(OI ? ' s uniquely determined as follows. (For conciseness we let a = 
p-n- LfErJ (* - l)andb = t-l-a = t-l-p + n+ [^\{t- l)-) 

= (Lf5fJ + i)Uf5rJ 6 */L^J + i<*<P-n + i. 

Proof. If t < [-\ the result is an immediate consequence of invariant g. If 
|_-J -\-l<t<p — n-\-l the result is a consequence of invariants h and i. □ 

7.4.4 The probability space associated to Prog 

By definition, a program prog in Prog has randomized invocations. The output val- 
ues of prog are the final values of Si, . . . , S p . The randomized invocations are internal 
actions. For each prog in Prog we can construct a probability space (S7', (/', P prog ) 
allowing to measure (in a probabilistic sense) not only the output - the schedules 
Si, . . . , S p - but also all the randomized invocations made by prog. 

We will need in Section 7.7 to analyze programs in Prog and to manipulate some 
events from (0', Q' , P pios )- We therefore describe informally the construction of this 
probability space. The sample space 0' contains the sequences of values produced 
by randomized invocations during executions of Prog , i.e., the realizations of the 
sequence (randomized-invocation!,randomized-invocation 2 , . . .). The u-field Q' is 
the power set of 0'. The measure P prog is the measure characterized by the relations 

-fprog • | P as t randomized invocations are r x , . . . , r t \ = P rii ... irt , 

one for each sequence r\, . . . , r t . By integration this means that, for every sequence 
r 1 ,...,r t , the probability P prog [(ri, . . ., r t )] is given by P e [r 1 ]P ri [r 2 ] ■ ■ ■P ri ,..., ri _ 1 [ r t], 
where we let P e denote the the probability attached to the empty sequence e. 

In contrast, recall that in Section 7.2 we constructed the sample space associated to 
protocols 7r to contain the sequences of values taken by random schedules i.e., the 
realizations of the sequence (Si, S 2 , ■ ■ ■)■ As each set St outputted by prog can be 
constructed from the sequence 

(randomized-invocation!,randomized-invocation 2 , . . .), 
we see that the u-field Q' is bigger then the one considered for protocols. For every 
prog in Prog , the measure P prog extends the measure vr prog defined on the set of 
schedules produced by prog onto this bigger space (0',£/'). 

Recall that, for every t, every ^-schedule a and every i-fault sequence adapted to a, 
the conditional probability 7r[ • | S t = cr] is well defined whereas 7r[ • | S t = o, T t = (f>] 
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is not. This is because the event {T t = <f\ is not expressible in terms of the schedule 
Si, S 2 , . . . and hence is not in the u-field over which the probability distribution it 
is defined. In Lemma 7.3.3 we formally made sense of this conditional probability 
for events in Q' t , i.e., for events describable in terms of the set St + i and in terms of 
the decisions a and (f> taken up to round t by both the protocol and the adversary. 
We let P w [- | St = a, T t = (f>] denote this extension. 

We can make a similar extension with P piog so as to compute the probability of 
events depending on the randomized invocations done by prog up to round t + 1 - 
the current round - and of past decisions (i.e., up to round t), conditioned on the 
past decisions taken by both the protocol and the adversary. To simplify we use 
also P prog to denote this extension. For instance, in the proof of Lemma 7.7.4 we 
will consider the expression 

P P ro e [T >t+l \ S t = a, F t = <f>,T >t, J(t + 1) = j] . 

7.4.5 The optimality property 

The optimization problem sup^ inf^ E W ^[T] is called the primal problem. We let t opt 
denote its value. Similarly the optimization problem inf^ sup,,. E W ^[T] is called the 
dual problem and we let t' opt denotes its value. A protocol 7r opt solves the primal prob- 
lem if t opt = t(ir opt ). 9 The existence of such a protocol implies in particular that the 
sup is attained in the primal problem and that max, inf^ E w ^[T] = inf ^ E^ ^ [T] . 
An adversary A opt solves the dual problem if t' opt = t'(A opt ) = sup^ E Wi ^ o t [T]. The 
existence of such an adversary implies in particular that the inf is attained in the 
dual problem and that min^ sup^ E W ^[T] = sup^ E Wi ^ o t [T]. 

The following adversary Aq plays a fundamental role in the understanding and the 
analysis of protocols in Prot(Prog ). 

Definition 7.4.1 We let Aq denote the adversary that selects at each round t an 
element chosen uniformly at random from s t — {/i , . . . , ft-i} if this set is not empty, 
and selects an arbitrary element from s t otherwise. 

This formally means that Aq = (Q v )vev where V is the family of i-odd-executions 
and where, for every v = (s l7 / l5 . . . , s t ), Q v is equal to lt St -y lt ...j t _ 1 } when s t — 
{fi,...,ft-i} ^ - and Q v arbitrary when s t - {f u . . ., f t _ 1 } = 0. 

Our main result is described in the next theorem. 



We presented in Page 143 the definition of of i(7r) for a protocol 7r: t(x) = inf^t -Ejr,yt[T]. For 
an adversary A, t (A) is denned symmetrically by t (A) = sup^ E^,a[T]. 
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Theorem 7.4.6 Every protocol ir in Prot (Prog ) solves the primal problem while 
the adversary Ao solves the dual problem. These two problems have the same value, 
equal to E WOtAo [T]. 

The two following lemmas are the crucial ingredients to the proof of Theorem 7.4.6. 
We defer their proof after the one of Theorem 7.4.6. The first lemma expresses that 
the protocols in Prot(Prog ) are optimal against adversary Ao- 

Lemma 7.4.7 Letir be a protocol in Prot (Prog ). Then max^ E WiAo [T] = E WOiAo [T]. 

The next lemma expresses that, when a protocol 7r in Prot(Prog ) is used, the 
expected time of survival of the system is independent of the adversary A used 
in conjunction with 7r . This implies in particular that Ao is optimal against the 
protocol 7T . 

Lemma 7.4.8 Let ir be a protocol in Prot(Prog ). Then E WOiA [T] is independent 
of A. 

We are now ready to prove our main result. 

Proof of Theorem 7.4.6: 

Let 7r be a protocol in Prot(Prog ). Then 

sup^-E^jT] = En 0tAo [T] (by Lemma 7.4.7) 

= inf^^ 0i ^[T] (by Lemma 7.4.8). 

By Lemma 8.2.2, sup^ inf^ E w iA [T] = inf^ E Wo iA [T] i.e., 7r solves the primal prob- 
lem, and similarly Ao solves the dual problem. Furthermore these two problems 
have the same value, equal to E WOiAo [T]. □ 



Note: As discussed in Section 7.1.2, the equality of the values of the primal and 
the dual problem is a direct consequence of Von-Neumann's theorem. 
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7.5 The Random Variables Cj(t) and L{(t) 

In Section 7.4, for every program prog in Prog , for every t and j, 1 < j ' < t < p, we 
defined Cj(i) to be the value held by the program variable Cj at the end of round t 
of prog. In this section we define the values Cj(t) to be random variables expressed 
in terms of the schedule S t . This definition is valid for arbitrary protocols and is 
compatible with the definition given in Section 7.4 in the special case of protocols 
in Prot(Prog ). (See invariant d of Lemma 7.4.1.) 

For each j and t, 1 < j < t, Cj(t) is the set of elements selected at time j and which 
are not used in ulterior rounds j + l,j + 2,...,t. C (t) is the set of elements of [p] 
that are not used in the first t rounds. We also introduce the random variables Li(t) 
counting the number of sets Cj(t), 1 < j < t — 1, which are of size i. 

An indication of the relevance of these random variables is indicated by Lemma 7.4.5 
which expresses that every prog in Prog is such that for every t, 1 < t < [p/n\ , 
L n (t) = t — 1 and Li(t) = if i j^ n; and such that for every t,t > [p/n\ + 1, 
U(t) = p - n - [^\(t - 1) if i = L^5rJ +l,L i (t) = t-l-p+n+[^\(t- 1) 
if i = LttyJ an d Li(t) = for any other value of i. We will see that these properties 
do in fact characterize optimal schedules. The following definition formalizes these 
notions. For a set $ in {1, . . . ,p}, we use the notation <I> C to denote the complement 
of $ in {1, . . .,p}. 

Definition 7.5.1 For every integers j and t, 1 < j < t < p and every k, < k < n 
we define the following random variables: 

c^t) = s\n (s 2 u...us t ) c 
c 2 (t) = s 2 n(s 3 u...us t ) c 

Cj(t) = s J n(s J+1 u...us t ) c 
c t (t) = s t . 

We extend the definition of Cj(t) to j = and set 

Co(i)=(u;- =1 Q(i)) c . 

We say that (C (t), . . . , C t {t)) is the c-sequence derived from the schedule (Si, . . . , St). 
For 1 < t < p and < i < n, we let Li(t) denote the number of sets Cj(t), 1 < j < 
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t — 1, which are of size i: 

L { (t) = \{cj(ty, i<j<t-i,\Cj(t)\ = i} . 

We extend the definition of Li(t) to i = n + 1 and set 

X n+ i(i)= |Co(i)l • 

As usual, we use lower case letters and write for instance c (t), Ci(t), . . . , c t (t) to de- 
note the realizations of the random variables C (t), C\(t), . . ., C t {t) and lo(t), . . . , l n +i(t) 
to denote the realizations of the random variables L (t), . . . , L n+ i(t). 

The next properties are simple but fundamental. Property 3 means that the system 
is still alive by time t if and only if for every j,j<t—l, the j'-th fault is in the set 
Cj. Let us emphasize that this property would not hold for m > 2. 

Lemma 7.5.1 Let t, 1 < t < p be arbitrary. Then: 

1. The family (Cj(t)) 0< j <t forms a partition of [p]. 

2- YZ= Li(t) = t-l. 

3. {T>t} = r^lliFj e Cj(t)} (= nLi{^ n {F,. . ., F^} = 0}). 

Proof. We easily check that the family (Cj(t)) 0< j <t is a partition of \p\. The 
condition XT=o Li(t) = t — 1 just expresses that the t — 1 sets C\(t), . . ., C t -i{t) 
are different and of cardinality between and n. As expressed by the formula 
{T > t} = f] t u=1 {S u fl {Fi, . . . , F u _i} = 0} that we recall for completeness, the 
survival time T is at least t if and only if, for every time u, 2 < u < t, S u does 
not contain any of i<\, . . . ,i r u _ 1 . (Note that this fact uses the hypothesis m = 1.) 
Equivalently, T > t if and only if, for every j, 1 < j < t—l,Fj is not contained in any 
of Sj + i, ..., St, i.e., if Fj G (^j+iU. . .USt) c . On the other hand, by definition, Fj G Sj 
for every j. Therefore T > t if and only if Fj G Cj(t) for every j, 1 < j ' < t — 1. □ 

Definition (7.5.1) establishes how a c-sequence (cj(t))j can be derived from a given 
schedule (s l7 . . . , s t ). The following lemma conversely characterizes the sequences 
('Jj)j that can be realized as a c-sequence from some schedule (s l7 . . . , s t ). This 
result will be used in Lemma 7.6.11 to characterize the optimal schedules. 
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Lemma 7.5.2 Let ji, . . . , ~{t-i be integers in the interval [0, n\. Then the condition 

n< JV-(7i + -.. + 7t-i) 

is a necessary and sufficient condition for the existence of a schedule (s l7 ...,s t ) 
satisfying \cj{t)\ = jj for all j, 1 < j ' < t — 1. 

Proof. We first establish the necessity of the condition. By Lemma 7.5.1, for all 
schedules (s l7 . . . , s t ), the family (cj(t)) 0< j <t forms a partition of [p]. This clearly 
implies that J2o l c j(0l = P an d hence that J2i \ c j(t)\ ^ P- 

Conversely, we prove by induction on t that, for every sequence 7 1 ,...,7 < _ 1 of 
integers in [0,ra] such that n < p — (71 + ... + 7t-i), there exists a schedule 
(si, . . .,«() whose associated c-sequence is given by Cj(t) = jj, 1 < j ' < t — 1 and 

c (t) = p - (7! + . . . + 7t-i) - n - 

• The property is trivially true for t = 1: in this case the family of conditions 
|cj(i)| = 7j, 1 < j < t — 1 is empty, and the set c (l) of processors not used has size 
p — \s 1 \ = p — n. 

• Assume the property verified for t, and consider a sequence ji, . . . , j t of integers 
in [0,ra] such that n < p — (71 + . . . + 7*)- This condition trivially implies that 
n < p — (7! + . . . + 7t-i). Therefore, the result at the induction level t being true, 
there exists a schedule (s l7 . . . , s t ) for which Cj(t) = 7^, 1 < j ' < t — 1 and such that 
the number of processors still unused at time t is 

|c (i)| = p- (71 + . .. + 7t_i) - n . 

We then construct a set s t+1 of n processors by taking any n — j t elements from the 
set s t and any j t elements from the set c (t) of unused processors. This construction 
is possible exactly when j t < |c (i)| i.e., when 

It < P~ (71 + ••• + 7t-i) - n , 

which is true: this is the induction hypothesis. Note that, by construction, the sets 
Cj(t), 1 < j < t — 1 are unaffected by the selection of the set s t+1 and hence: 

1^ + 1)1 = 1^(01 = 7,, 1 < i < * - 1 ■ 

On the other hand, 

|ci(i + l)| = |si|-(n-7i) 
= It ■ 
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To finish the induction from t to t + 1, we note that 

|c (* + 1)| = |c (*)l - T* 

= P~ (7i + •••+ lt-i +lt) ~ n . 

D 

The schedules in normal form that we now define will be shown in the sequel to be 
the schedules maximizing the expected survival time. In essence, a ^-schedule a is in 
normal form if the sizes of the sets Cj(t), 1 < j < t — 1, (of the c-sequence associated 
to it), differ by at most one, and if c (t) is not empty only if every Cj(t), 1 < j ' < t — 1 
is of size n. Formally: 

Definition 7.5.2 Let t > 1 be a time. We say that a t-schedule a is in normal 
form and write 

if there exists a t , < a t < n, s.t., 

f Vj, 1 < j < t - 1, \cj(t)\ = a t or \cj(t)\ = a t + 1 , 
\ \c (t)\ >0=> a t = n . 

We then also say that (c (i), . . .,c t -i{t)) is in normal form. 

Invariants g and h of Lemma 7.4.1 express that the programs in Prog all produce 
schedules in normal form. We next show that a ^-schedule a is in normal form if and 
only if the associated sequence (lo(t), ■ ■ . ,/„+i(i)) has at most two non-zero terms, 
which are consecutive. 

Lemma 7.5.3 A t-schedule a is in normal form if and only if there exists a t ,0 < 
a t < n + 1 such that the associated sequence (lo(t), ■ ■ ■ , / n +i(0) satisfies the equality 

(l (t), ..., l n+1 (t)) = (o, . . . , 0, l at (t), l at+ i(t), 0, . . . , o) . 
Proof. Simple consequence of Definitions 7.5.1 and 7.5.2. □ 

The next lemma shows that, for every t, ^-schedules in normal form have a unique 
associated sequence (lo(t), ■ ■ .,l n +i(t)) and that, conversely, this value characterizes 
^-schedules in normal form. We will use this property in Lemma 7.6.11 to show that 
a property is specific to schedules in normal form. 
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Lemma 7.5.4 1. Let 1 < t < [p/n\. Then a t-schedule a is in Af t if and only 
if the only non zero terms of the sequence (lo(t), ■ ■ . ,/„+i(i)) are l n {t) = t — 1 and 
l n+ i(t) = p — tn. (And hence, a t = n.) 

2. Let t > [p/n\ . Then a t-schedule a is in Af t if and only if the only non zero 
terms of the sequence (lo(t), • • • , l n+ i(t)) are 

U0= L^tJ(*-i) + * + »-p-i 

and, if p — n is not a multiple oft — 1, 

l at+1 (t)=p-n-[^\(t-l), 
where 

Proof. • If t < [p/n\ then tn < p. Working by contradiction, assume that 
there exists i < n such that /,(i) > 0, i.e., that there exists a set Cj (t) such that 
l c io(0l < n - Then 

iU c >(*)i < Ei c >(*)i 

i=i i=i 

= E K'WI + K(t)\ 
< tn < p . 

As the family (cj(i)),0 < j ' < i, is a partition of [p], c (i) must be not empty which, 
by the normality property, implies that all the sets Cj(t), 1 < j ' < t — 1, must have 
size n. Hence 

l n (t) = \{ Cj (t); l<j<t- l,\ Cj (t)\ = n}\ 
= t-1. 

This in turn implies that 

/ n+1 (*) = |c (*)l = P-\{Jcj(t)\ 

i=i 
= p — nt . 

• Consider now the case t > [p/n\ . Working by contradiction, assume that l n+ i(t) > 
0. Then, by the normality condition, all the sets Cj(t), 1 < j ' < t— 1 must have size n. 
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We have: 

t t 

| M Cj(t)\ = 2_]\cj(t)\ (since the sets Cj(t) are disjoint) 

3=1 3=1 

= tn 

> ([p/n\ + l)n 

> P, 

a contradiction. Hence l n+ i(t) = 0, i.e., c (t) = 0. Hence the t—1 sets Ci(i), . . . , c t _i(t) 
must divide p— \s t \ = p — n elements among themselves. Lemma 7.4.3 (where we re- 
place q by p—n and t by t—1) shows that a t = [jz^\ , l at (t) = [jE~[\(t— l)+t+n— p— 1 
<mdl at+1 (t)=p-n-l p -^\(t-l). a 
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7.6 7Tq is optimal against Aq 

This section is devoted to the proof of Lemma 7.4.7. 

7.6.1 Sketch of the proof and intuitions 

For a given adversary A, an optimal protocol is one that, at each time t-\- 1, exploits 
to its fullest all the information available so as to optimize the choice of S t +i- There- 
fore to construct an optimal protocol, we first analyze the notion of "information 
available to the protocol". We distinguish between the explicit information, for- 
mally described in the model, and the implicit information that an optimal protocol 
is able to deduce. Consider for instance the case of the identity of the adversary 
A. In Section 7.2, when modeling protocols and adversaries, we did not provide a 
mechanism allowing a protocol to be informed of the identity of the adversary that 
it plays against. This means that the protocol does not know explicitly the identity 
of the adversary. Nevertheless, for a given adversary A, there is one protocol that 
always assumes that the adversary is A and takes optimal decisions based on this 
assumption. This protocol is by construction optimal if the adversary is A. We 
then say that the optimal protocol knows implicitly the identity of the adversary. 

In Section 7.2 we modeled a protocol to be an entity deciding the whole schedule 
(Si, . . . , S p ) ahead of time, i.e., in an off-line fashion. Si is the first selected set, 
and for every t, t > 1, ^t+i is the set selected to be used after the occurrence of the 
t-th fault. In this model the adversary "sees" the sets St only when they come in 
operation. 

Alternatively, we could have modeled a protocol to be an entity interacting in an 
on-line fashion with the adversary: in this model, at each occurrence of a fault, the 
adversary informs the protocol of the occurrence of a fault and whether the system 
is still alive at this point. If the system is still alive the protocol then selects the set 
St+i to be used next and communicates its choice to the adversary. 

It might seem that in our model - the off-line model - the protocol is weaker then 
in the on-line model, as, for every t, it has to select the set ^t+i without knowing 
whether the system is alive after the t-th fault. Nevertheless we easily see that, in 
the off-line model, the protocol can assume without loss of generality that T > t, 
i.e., that the system is alive after the i-th fault, while selecting the set S t +i for time 
t + 1. Indeed, if this happens not to be the case and the system dies before time 
t + 1, all the decisions and assumptions made by the protocol for time t + 1 are 
irrelevant . 
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This discussion shows that the off-line and the on-line model of a protocol are 
equivalent so that we can adopt the on-line model in this informal presentation. 
From the on-line description, it is clear that, for every t, the information about the 
past execution available to the protocol upon selecting the set S t +i consists of its 
own past decisions, i.e., of S t = <7, and of the fact that the system is still alive at 
this point, i.e., of T > t. Note that the information T > t is given explicitly to the 
protocol in the on-line model and only given implicitly in the off-line model that we 
chose in Section 7.2. 

For every t, upon selecting a new set S t +i, an optimal protocol can use all the 
information available and guess first what are the locations i<\, . . .,F t of the faults 
already committed by the adversary. To "guess" the protocol uses the probability 
distribution 

P A [(F 1 ,...,F t )= ■ \T>t,S t = a], 

i.e., the probability of the value allocated to (i<\, . . .,F t ) by the adversary A, con- 
ditioned on the knowledge of the past execution held by the protocol. 

By Lemma 7.5.1, the system is alive at time t, i.e., T > t, exactly if Fj is in Cj(t) for 
every j, 1 < j ' < t — 1. (This is not true for m > 2.) Hence the previous probability 
can be rewritten P A [(Fi, . . . , F t ) = ■ | n*- =1 {-F} G Cj(t)}, S t = a], which shows 
the relevance to the analysis of the sets Cj(t). In this section the adversary is the 
random adversary Aq defined in Definition 7.4.1. In this case, by definition, at each 
time t, a fault occurs uniformly at random in St and we can then further establish 
in Section 7.6.2 that P Ao [(F u ...,F t )= ■ \T>t,S i = a] = ®) =l U Cj{t) . 

This result fully elucidates the notion of "information available to the protocol" and 
we can say that a protocol optimal against Aq is one that, for each t, uses most 
efficiently the probabilistic guess P Ao [(Fi, . . .,F t ) = ■ \ F > t, S t = cr] in order to 
chose a "most appropriate" set ^+1 for time t + 1. The next challenge towards the 
construction of optimal protocols is to understand how, for every t, such a "most 
appropriate" set ^+1 is selected. For this we use the general equality 

E 1c , Ao [T] = 52P 1CtAo [T>t], 
t>i 

established in Lemma 8.1.2. A natural idea is to try the following greedy strategy. 
Select a set s maximizing the quantity Pa [T > 1 | Si = s]. Then select a set s 
maximizing the quantity Pa [T > 2 | T > 1, S 2 = (s l7 s)]. Generally, assuming that 
the schedule St = (s l7 . . . , s t ) has already been chosen and assuming that the system 
is still alive at time t, i.e., that T > t, we select a set s maximizing the probability 

P Ao [T>t + l\T>t, S t+ i = ( Sl ,...,s t , s)] 
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of being alive one more time. If the protocol it defined by this procedure maximizes 
Pw,a [T > t] for every t, it also maximizes the sum J2t>i Ptt,Ao[P — t\ an( i hence is 
a protocol optimal against Aq. As is discussed in Section 7.6.4, this is true if the 
schedule a = (s l7 . . . , s t ) greedily chosen as described above maximizes the quantity 
PA [T>t\S t = a}. 

We therefore compute this quantity P^ [T > t \ S t = cr] for every a and show that it 
is equal to n!=i „ , where the values Cj(t), 1 < j ' < t are uniquely derived from a. 
This computation uses critically the relation Pa [(Fi, . . . , F t ) = ■ \ T > t, S t = a] = 
®j=i^c 3 (t) discussed above. We establish that the schedules maximizing this value 
are the schedules for which all the associated terms |cj(i)|, 1 < j < t—1, differ by at 
most one, i.e., the schedules in normal form. (See Definition 7.5.2.) By invariants 
g and h of Lemma 7.4.1, all protocols in Prot(Prog ) produce such schedules and 
hence are optimal against Aq. This is formally established in Section 7.6.5. 

The results established in Section 7.6.4 also show that the schedules produced by 
the greedy procedure previously described are in normal form, and hence that the 
greedy procedure is optimal against Aq. Actually, the protocols produced by the 
greedy procedure are exactly those in Prot(Prog ). 

7.6.2 Analysis of the distribution of the random variables Fj 

Let t and j such that < t < p — 1, and 1 < j ' < t. Assume that the adversary 
is the random adversary Aq defined in Definition 7.4.1. The next lemma says that, 
conditioned on the past schedule and on the fact that the system is still alive at 
time t, 

• each random variable Fj has a uniform distribution on the set Cj(t), 

• the random variables (Fj)i<j<t are independent. 

This lemma will be a crucial tool for the estimation of the probability Pa [F > 
t\S t = a] done in Lemma 7.6.10. 

Lemma 7.6.1 Letl < t < p and a £ Feas^ . 10 Fhen, for every family (<J> l5 ... , $ t ) 
of subsets of [p], 

t 
P4 [(Fi,...,F t )<E($i,. ..,$,) I F>t,S t = a] =n w «= i (*)[$i], 



See Page 149 for the definition of Feas^ . 
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where Cj(t), 1 < j < t, are the values of Cj(t), 1 < j < t, uniquely determined by the 
condition S t = a. 

Lemma 7.3.5, page 148, justifies the well-formedness of this statement. 

Proof. Define (fii,£/i,-Pi) to be the probability space (^l,Q,P^ ). Using the no- 
tions recalled in Definition 8.1.2 we can reformulate the statement of Lemma 7.6.1 
into the concise form: for all t, < t < p — 1 and all ^-schedule a in Feas^ , 



C[{F u ...,F t ) T>t,S t = a 



C[Fi 



T>t,S t = a 



)U Cjit) . 



(7.11 



Equation 7.1 holds vacuously for t = 0: the family (Fi)i <i<t is empty and there 
is nothing to prove. We now work by induction on t,0 < t < p — 1: assume that 
Equation (7.1) has been established for time t. To progress from t to t + 1, we first 
prove that, for every ^-schedule a and and every s £ V n {p) such that (<7, s) is in 
Feas^ , for every j, 1 < j < t + 1, 



C(F; 



F>t+l,S t+1 



[Vt 3 , 



U r 



:(* + !)• 



(7.2) 



• Consider the case j = t + 1. This case corresponds to the processor _F i+1 selected 
at time t + 1 by the adversary. We want to prove that, C[ F t+i F > t + l,<S i+ i = 



{a, s) l = U Cl+1 ( t +i). Conditioning on T > t + 1 ensures that the adversary did not 
select a processor of s at a time prior to t + 1. Hence, at the end of time t + 1, 
there is exactly one faulty processor, F t+ i, amongst the set s. As Aq is the random 



adversary, _F i+1 is uniformly distributed in s, i.e., has a law equal to U s = U, 



C t + i(t + l)- 



• Let j be any integer, 1 < j ' < t. We let F' denote the random variable [Fj 
t,S t = <J ) . Then 



T > 



£{F 7 T>t + l,S i+1 



(a,s 



Pa [f s e-\F>t,S t = a, F, $s,...,F t $s] 
Pa \f 3 e-\T>t,S t = a, F 3 #s] 



(7.3) 
(7.4) 
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p Ao [F;e- f;? s \ (7.5) 

Ucwl^Fjts] (7.6) 

W«=i(On.? +1 f • ] (7-7) 



- ZY Ci (t+i) • (7.8) 

Equality 7.3 comes from the fact that, conditioned on the schedule S t = cr and the 
fact that the system has survived up to time t, the system survives at time t + 1 
exactly when the set s selected at time t + 1 contains no processor broken at a 
previous time. Equality 7.4 comes from the fact that, by our induction hypothesis 



at level t, [Fj F > t,S t = cr) is independent from [F t F > t,S t = cr) ; 1 < i < 
t,i j^ j. Equality 7.5 comes from the fact that, conditioned on {F > t,S t = a}, the 
condition Fj ^ s is equivalent to Fj (j£ s. Equality 7.6 comes from the fact that, by 
our induction hypothesis at level t, 

PA [Fje-] = u Cj(t) [-]. 

Equality 7.7 is a simple application of Lemma 8.1.3: again, remember that U Cj {t) is 
the law of Fj. Equality 7.8 comes from the definition of Cj(t + 1). This finishes to 
establish that Equation 7.2 holds for every j, 1 < j ' < t + 1. 

A consequence of Equation 7.2 is that, for every j, 1 < j ' < t, the support of 
[Fj F > t,S t = cr) is equal to Cj(t). By Lemma 7.5.1 the sets Cj(t) are all disjoint. 
This trivially implies the independence of the random variables and concludes the 
proof by induction of Formula 7.1. □ 

The proof of the next result can be omitted in first reading. It will be used in the 
next section and in Lemma 7.6.11 where optimal schedules are characterized. 

Corollary 7.6.2 Let a be a schedule and let (l (t), . . . ,l n+ i(t)) be the associated 
sequence as described in Definition 7.5.1. Then a is in Feas^ if and only iflo(t) = 0. 



Proof. 

• Assume that a £ Feas^ . Then, by Equation 7.1, 



C (F U ...,F 



F>t,S t = u) =(g)U, 



,(*)• 
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The uniform distributions U c ,(t) are well defined probability distributions only if 
Cj (t) ^ for j, 1 < j < t - 1, i.e., if l (t) = 0. 

• We now prove the converse and assume that (s l7 . . . , s t ) is a schedule which is not 
in Feas^ . We want to establish that lo(t) > 0. 

Note first that every set Si of size n is clearly in Feas^ . (Consider the protocol 
7r such that S t = «i for all t. Then P W ^ [T > 1,5\ = Si] = Pn-^fT > 1] = 1 5 
because m = 1.) This establishes that t > 1. Let f , 1 < v < t be the smallest 
u such that (s l7 . . .,s u ) (j£ Feas^ . Using the formulation given in Remark 1 after 
Definition 7.3.3, page 149, and using Lemma 7.3.2 we obtain 



whereas 

Therefore: 

= P Ao [T>v 



Pa \T>v 



P Ao \T>v-l 







Sv — ( s l? • • • i s v)\ 

Sv-1 = \ S l7 ■ ■ ■ 7 S V-l)\ > 



:7.9) 



6„ 



(si, . . ., s v ) 



(si, . . . , s v ) 



Pa [t>v,T>v-1 

Pa [t > v \T > v - 1,S V = ( Sl , . . . ,s v )] ■ P Ao [T > v - 1 



6„ 



(si, . . . , s v ) 



Pa \T>v 



T > v - 1, S v = (s 1 , . . . , s v )\ ■ Pa [T > v - 1 5„_i = (si, . . . , s^7i.)J0) 

where the last equality is a consequence of Lemma 7.3.6. 

Using Equations 7.9 and 7.10 allows us to derive the first next equality. 





Pa \T>v 



T > v - 1,S V = (si,...,s„)J 
P Ao [s v ri{F 1 ,...,F v _ 1 } = 9\ T>v-1, S v = ( Sl ,...,s v j\ 
Pa [s v n{F u ..., F„_!} = I T>v-1, £„_! = ( Sl ,..., s„_!)] (7.11) 

v-l 

Pa [ C\i F i^ s l}\ T>v-1, «S„-i = (*i,...,s„-i)] 



Y[Uc 3 (v-l)[sl], 



(7.12) 



where Equation 7.11 comes from Lemma 7.3.6 and Equation 7.12 from Lemma 7.6.1. 
The nullity of the product in 7.12 implies that there exists j, 1 < j < v — 1, such 
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that 

w Ci( „-iK] = o 

i.e., slHCjiv -I) = ® 
i.e., Cj(v) = , 

and this implies that lo(v) > 0. To finish, note that the sequence (lo(u)) u is a non- 
decreasing sequence so that lo(v) > implies that lo(t) > 0, which was to be proven. 

□ 

7.6.3 A max-min equality for the maximal survival times 

Our final proofs will rely on the equality E W ^[T] = J2t>i Pk,a[T > t] and will 
entail an analysis of each of the non-zero terms of this summation. This section is 
concerned with finding which of these terms are non-zero. 

Following the definitions given in Lemma 8.2.4 we define £ max (.4) = max{ i; sup„.- 
Pw,a[T > t] > } and t min (ir) = max{ t; inf^t P W ^[T > t] > }. (Note that, for every 
A and every it, P w ^[T > t] = if t > p. This justifies that sup{ t; sup,,. P W ^[T > 
t] > } = max{ t; sup^ P W ^[T > t] > }. We similarly show that the supremum is 
achieved in t min (ir).) 

We easily see that, for a given adversary A, we can limit the range of summation of 
the series J2t>i Pk,a[T > t] to within the first £ max (.4) terms. For a given protocol 7r, 
the interpretation of t min (ir) is in general a bit more complicated: if inf^ P W ^[T > 
t m in(^) + 1] = min^t P W ^[T > i m i n (vr) + 1](= 0), then there exists an adversary A for 
which only t min (ir) terms of the series J2t>i Pk,a[T > t] are non-zero. 

Note that all the values £ max (.4) are a priori bounded by p. Hence Lemma 8.2.4 
shows that the quantities £ max (.4) and t min (ir) satisfy the max-min equality 

maxi min (7r) < mini max (yl) . 

7T A 

In this section we show that we can strengthen this inequality into an equality in 
the special case where m = 1. (See Corollary 7.6.9.) Lemma 7.6.8 will also be useful 
in the sequel of this work. 

Let t, t < p be a time, a be a ^-schedule and (f> be a ^-sequence of faults adapted to 
a. We let t a ^ be the survival time of schedule a used in conjunction with (f>. By 
definition, t a ^ is less then equal to t. 

Lemma 7.6.3 Let t,t < p be a time, a be a t-schedule and (f> be a t-sequence of 
faults adapted to a such that t a ^ = t. Then Aq G Agenerating a (cj)) . 
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Proof. This a direct consequence of the definition of Aq. At each time, Aq selects 
with non zero probability every element non already selected. Hence Aq selects a 
with non-zero probability. □ 

Lemma 7.6.4 Let t,t < p be a time, a be a t-schedule and (f> be a t-sequence of 
faults adapted to a. Then P W ^[T > t,S t = a, T t = (f>] > if and only if t a ^ > t, 
vr G P generating (a) and A G Agenerating a (<f)) . 

Proof. This is a direct consequence of the fact that, conditioned on S t = o and 
T t = 4>,T > t is equivalent to t a ^ > t. □ 

Lemma 7.6.5 For every t > p — n + 1 there is no t-schedule a and no t-fault 
sequence (f> such that t a ^ > t. 

Proof. Working by contradiction, consider t > p — n-\- 1 and assume the existence 
of such a schedule a and of such a fault sequence (f>. Consider the point just after the 
selection of the i-th fault f t by the adversary. The hypothesis t a ^ > t implies that, 
at this point, s t contains n— 1 non-faulty elements. On the other hand the t elements 
/i, . . . , /i are faulty. Hence we must have p > t + n — 1 which is a contradiction. □ 

Lemma 7.6.6 Let t be a time and it a protocol. Then P W ^[T > t] > only if 

iW r >*]>o- 

Proof. The condition P W ^[T > t] > implies that there must exist a ^-schedule 
a and a ^-sequence of faults (f>, adapted to a, such that P W ^[T > t,S t = o,J- t = 
4>] > 0. By the only if part of Lemma 7.6.4, it must then be the case that t a ^ > t, 
that 7r G P generating (^a) and that A G Agenerating a (cj)) . By Lemma 7.6.3, Aq G 
Agenerating a (cj)) . By the if part of Lemma 7.6.4, P W ^ [T > t,S t = a, T t = (f>] > 
and hence P^JT > i] > 0. D 

In the following lemma, l (t) is the value related to a as defined in Definition 7.5.1. 

Lemma 7.6.7 Let t,t < p be a time and it a protocol. Then t < t min (ir) if and only 
if there exists a t-schedule a such that / (i) = and such that P w [St = a] > 0. 



Proof. If part. 



P*,A [T>t] > P*, Ao [T>t,S t = a] 

= PA [T>t\S t = a]P w [S t = a] 
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By assumption, the term P w [St = a] is positive. On the other hand, by Corol- 
lary 7.6.2, the assumption l (t) = implies that a G Feas^ i.e., that P^ [T > t \ 
S t = a] > 0. Hence 

mfP^[T>i]>P^ o [T>*]>0. 

A 

This inequality, along with the definition of t min (ir) shows that t < t min (ir). 

Only if part. By definition of t min (ir), there exists an adversary A such that 
Pw,a[T > i] > 0. By Lemma 7.6.6, this implies that P W ^ [T > t] > 0. Hence 
there must exist a ^-schedule a such that P W ^ [T > t,S t = cr] > 0. This implies 
that -Pjr^JiSt = ct] > and that a G Feas^ i.e., by Corollary 7.6.2, that lo(t) = 0. 

D 

Lemma 7.6.8 For all A, for all ir in Prot(Prog ), t min (ir ) = £ max (.4) = p — n + 1. 

Proof. For every adversary A and every protocol 7r, the inequality t min (ir) < 
! mai ,(yl) is true for any m > 1 and stems from the general result of Lemma 8.2.4 We 
prove that the converse inequality holds in the special case where m = 1 and where 
the protocol is in Prot(Prog ). 

Let t < p — n-\- 1 and let 7r G Prot(Prog ). Every ^-schedule a selected by 7r is such 
that lo(t) = 0: by invariants g and h of Lemma 7.4.1, for every j, 1 < j ' < t — 1, the 
set Cj(t) has size at least min(ra, [737]) > 1- This fact together with Lemma 7.6.7 
implies that t min (ir ) > p — n + 1. On the other hand, Lemmas 7.6.5 and 7.6.4 
imply that P W ^[T > p — n + 1] = for every protocol it and every adversary 
A. This fact implies that t min (ir) < p — n + 1 and that £ max (.4) < p — n + 1 for 
every it and A. Hence, for every A, t ma , x (A) < p — n + 1 = t min (ir ). This, along 
with the inequality t min (ir ) < £ max (.4) previously established implies the equality 
^min(vro) = t m!LX (A) = p - n + 1, valid for every A. □ 

Corollary 7.6.9 max, i min (7r) = mm A t m ^(A). 

Proof. By Lemma 8.2.4, max, ^ m i n (7r) < min^ £ max (.4). Conversely, let ir be any 
protocol in Prot(Prog ). We have: 

mmt^A) = i min (7r ) (by Lemma 7.6.8) 

< maxi min (7r) . 

7T 

It follows that max, t min (ir) = min^t £ max (.4). □ 
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7.6.4 Schedules in normal form are most efficient against Aq 

The next lemma is crucial to evaluate the performance of a schedule. In essence, 
for a given schedule <7, it allows to compute for each time t the probability that 
the system survives one more time when following the schedule <7, provided that 
the system survived thus far and that the adversary is Aq. It will allow us in 
Lemma 7.6.11 to characterize the schedules that perform best against Aq. 

Lemma 7.6.10 For every t > 1 and every t-schedule a the two following equalities 
hold: 



t-i 



P4T>t\s i = a,T>t-l]=R J ^L j - l (7.13 



I Cj (01 



;,(*) 



^o[r>*|5 t = a] = n i ^ I = II 1 ^. ( 7 - 14 ) 



, n :*■■*■ n 

= 1 z = 



where Cj(u), 1 < j < u < t are uniquely derived from a and where, by convention, 
we set 0° to be equal to 1 and 0/0 to be equal to 0. 

Corollary 7.3.5, page 148, justifies the well-foundedness of the probabilities com- 
puted in Lemma 7.6.10. 

Proof. Consider first the case where a g - Feas^ . By Remark 1 on page 149, the 
left-hand side P^ [T > t \ S t = a] of Equation 7.14 is equal to 0. As 



[r> t T>t- i,s t = ct] 



Pa I T > t 



Pa [T > t, S t = a] 
Pa [T > t - 1, S t = a] ' 



the left hand side of Equation 7.13 is also 0. (Note that, by Convention 8.1.1, 
the left-hand side P^ [ T > t \ S t = a, T > t — 1] is automatically set to in the 
special case where P^ [T > t — 1, St = a] = 0. On the other hand, in this case, 
the convention 0/0 = also gives to the right-hand side.) On the other hand, 
by Corollary 7.6.2, the condition a (j£ Feas^ implies that / (i) > 0, i.e., that there 
exists j, 1 < j ' < t — 1 such that |cj(i)| = and hence that n?=i l c i(^)l = 0- This 
implies that the right hand side of both Equations 7.13 and 7.14 is equal to zero. 



We can therefore restrict ourselves in the sequel to the case where a = (s l7 . . . , s t ) G 
Feas^ . 
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a. We begin with the proof of Equation 7.13. 

PA \T>t 



S t = a,T>t-l] 

p Ao [n'-JAF, e s c t } |5 t _! = (s u . ..,*_!), r > * - 1] (7.15) 

t-i 

n w <i(*-iK] ( ? - 16 ) 

i=i 

ffl^nc^-i)! (717) 



Equation 7.15 is a consequence of Lemma 7.3.6. Equation 7.16 is a simple application 
of Lemma 7.6.1. Equation 7.17 is a simple application of the fact that U Cj ( t -i) is the 
uniform distribution on Cj(t — 1). Equation 7.18 comes from the definition of Cj(t). 
This finishes to establish Equation 7.13. 

b. We now turn to the proof of Equation 7.14. 

PA [T>t\S t = (s u ...,s t j\ 

= P Ao [T>t,T>t-l,...,T>l\S t = ( Sl ,...,s t 

= P Ao [T>t\T>t-l, S t = ( Sl ,...,s t j\ 

■P Ao [T>t-l\T>t-2, S t = ( Sl ,...,s t j\ 

■■■ Pa [t>2\T>1, S t = (s u ...,s t j\ -P Ao [t>1\ S t = (s u ...,s t )] 

= P Ao [T>t\T>t-l, S t = ( Sl ,...,s t j\ 

■P Ao [T>t-l\T>t-2, 5 t _! = (si, . . . , s*-i)] 

••• Pa [t>2\T>1,S 2 = ( Si ,s 2 )] ■Pa [t>1\S 1 = s 1 

\ c j( u )\ 



7.19) 



7.201 



nn 

u=2j=l 
t-l t 

n n 



i l c iO- 1)1 

\ c j( u )\ 
1,4+1 M M -1) 



7.21) 
7.22) 
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= nic,-(*)i/ic,-(i)i 

i=i 
t-i 

= n i c i(^)i/^ • 

i=i 

Equation 7.19 is justified by the equality {T > t} = {T > t, T > t — 1, . . . , T > 1} . 
Equation 7.20 is obtained by successive conditioning. Equation 7.21 is a consequence 
of Lemma 7.3.6. Equation 7.22 is a consequence of Equation 7.13 and of the simple 
property P Ao [T > 1 | S x = s x ] = 1. D 

The following lemma establishes that, for every time t, 1 < t < t m ^ x (Ao), the set of 
^-schedules a maximizing the probability P Ao [T > 1 1 S t = o\ is equal to the set Af-t 
of ^-schedules a in normal form. 

Lemma 7.6.11 For any t, 1 < t < t m ^ x (Ao), the value P Ao [T > 1 1 S t = a] is the 
same for all t-schedules a in Af-t- We let P Ao [T > 1 1 S t G Af-t] denote this common 
value. Furthermore, let a' be a t-schedule. We have: 

1. If a' £ Af t , then 

PA [T>t\S t = a'] = m<ixP Ao [T>t\S t = a]. (7.23) 

a 

2. Conversely, if a' $l Af t , then 

PA [T>t\S t = a'] < m<ixP Ao [T>t\S t = a]. (7.24) 

a 

Proof. By Lemma 7.6.10, that, for every ^-schedule a, 



, n n n 

1 z = 



A first consequence of this fact is that the value P Ao [ T > t \ S t = a] depends on a 
only through the values (/ (i), .. .,/„(/)). By Lemma 7.5.4, there is a unique and 
well defined sequence (/ (i), .. .,/„(/)) to which all schedules in Af t are associated. 
This implies that the probability P Ao [T > t \ S t = a] takes only one value when a 
varies in Af t - This fact justifies the notation 

Pa [T > 1 1 S t e AT t ] = P Ao [T > 1 1 S t = a'} , 
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for any arbitrary schedule a' in Af t - 

Taking into account that all schedules a' G Af-t give rise to the same value P Ao [ T > 
t\S t = a'], we see that Equation 7.23 is a consequence of Equation 7.24 that we 
now set out to prove. By definition of i max («4 ) 5 the condition t < t m ^ x (Ao) implies 
that < sup,,. P W ^ [T > t] , so that, by Lemmas 8.1.4 and 7.3.2 

< supP^ [T>i] 

7T 

< supmaxP^jT > t \S t = a] 
= max sup Pr Ao [T > t \S t = a] 

a n 

= maxP Ao [T>t\S t = a] . (7.25) 

a 

Working by contradiction, assume that there exists a ^-schedule a not in normal 
form but which maximizes the probability P Ao [ T > 1 1 S t = cr] . The non-normality 
of a implies that 

a. either there exists j\ and j 2 in {1, . . .,t — 1} such that 1^(7)1 < |cj 2 (i)| — 2, 

b. or c (t) 7^ and there exists j in {1, . . .,t — 1} such that |cj(i)| < n — 1. 

We first consider case a. In this case: 

PA [T>t\S t = a] = n'Mli 

/=i n 

tt \cj(t)\ \c h (t)\ \ C :M _ 

XX m in ti 



Define the sequence (ji, . . . ,7t_i) derived from the sequence (|ci(i)|, . . ., |cj_i(i)|) 
by replacing 1^(7)1 by | c^- x ( ^ ) | + 1 and |cj 2 (i)| by |cj 2 (i)| — 1. Note that 

X> = X>(*)I- (7-26) 

i=i i=i 

By the only-if direction of Lemma 7.5.2 we have that n < p — (|ci(i)| + . . .+ |cj_i(i)|). 
By Equation 7.26 we therefore also have n < p— (71 + . . . + 7 t _i). By the if direction 
of Lemma 7.5.2 there exists a schedule a' = (s[, . . . , s' t ) whose associated c-sequence 
(c[(t), . . . ,Cj_ 1 (i)) satisfies |c'-(i)| = 7,-, 1 < j < t — 1. We compute: 

(\c h (t)\ + 1) • (\c j3 (t)\ - 1) = \c h (t)\ ■ \c j3 (t)\ + \c j3 (t)\ - \c h (t)\ - 1 

> MOI-MOI + i, 
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because, by assumption, 1^(2)1 < |cj 2 (i)| — 2. 
Then 

Pa [T >t\S t = a'] 



n 14(01 



=1 n 



TJ \Cj(t)\ \ Cjl (t) + l\) \c j2 (t)-l\ 



je{l,...,t-l};j#jij2 
> TT l c j(OI l c ji(OI l c j 3 (*)l / 72? x 

, n n n 

je{i,.--,*-i};j#jU2 

= Pa [T > 1 1 5 t = a] . 

In Equation 7.27, the inequality is strict because, by Equation 7.25 and the fact 
that 

PA [T>t\S t = a]Jfi^, 

(see Equation 7.14), all the terms |cj(i)|, 1 < j < t — 1 must be non-zero. 

But this contradicts the fact that, by assumption, the schedule a maximizes the 
probability P^ [ T > 1 1 S t = o\ ■ This concludes the analysis of case a. 

Case b is similar but easier. We could proceed as in a and use Lemma 7.5.2 to 
prove non-constructively the existence of an improving schedule. Just for the sake 
of enjoyment, we adopt another another proof technique and provide an explicit 
modification of the schedule a. 

By assumption c (t) j^ and there exists j in {1, . . .,t — 1} such that |cj (i)| < 
n — 1. Note that the sequence (cj ( u ))u>j is a non-increasing sequence of sets 
such that |c jo (jo)| = |s(jo)| = n - Hence there must exist a time ji,jo < ji < t 
such that |cj (ji)| < |c j0 (ji)| — 1. Consider the smallest such j\. By the definition 
of the set Cj (ji), (see Definition 7.5.1), this implies the existence of an element 
x G s(jo) H s(ji). Let y be any element in c (t). Define 

%) = Kji)-W)U{!/}, 

and s'(j) = s(j) for all j ^ j\. Let c[(t), . . . , c^_ 1 (i) be its associated c-sequence. We 
easily check that |c'- o (i)| = |cj (i)| + l and that c'At) = Cj(t) for all j, 1 <J <(,j/ jo- 
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Hence 

p,i [r>i|«s t = k,...,*;)] 
= gK-(*)l 



=1 ra 



TT |C>(*)I K(t)\ + 1 



?e{i,. -,*-i};j'#j'o 



> TT l c j(*)l 

= Pa [T > 1 1 «S t = a] . 

As in case a, this contradicts the assumption that the schedule a maximizes the 
probability P^ [T > 1 1 S t = o\ ■ This concludes the analysis of case b. D 

7.6.5 Protocols in Prot(Prog ) are optimal against Aq 

Recall that the notation P^ [T > t\S t G Aft] was introduced and defined in 
Lemma 7.6.11. 

Lemma 7.6.12 For every t, sup^ P^JT > t] = P Ao [T > t\S t G M t ]. Further- 
more, for t < t m ^ x (Ao), a protocol it maximizes the probability P W ^ [T > t] if and 
only if P w [S t G Af t ] = 1. 

Proof. 

• Let a' be some schedule in Af t - Let it' be a protocol such that P w i [S t = a'] = 1. 
Then 

supP^ [T>i] > P^, Ao [T>t] 

■K 

= P«>,A [T>t | S t = a'] 
= PA [T>t | 5 t = a'] 
= PA [T>t\S t eAT t ], 
where the last equality is a consequence of lemma 7.6.11. 

• Conversely, let it be any protocol. The beginning of the following argument repeats 
the proof of Lemma 8.1.4. 

P,,Ao[T>t] = J2 P -,^[T>t \ S t = a] ■ P WtAo [S t = a] 
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= J2 P ^[T>t | S t = a] -P w [S t = a] 

a 

< maxP io [T >t\S t = (r]-^2P 1c [S t = (T] (7.28) 

a 

= max P Ao [T >t | S t = a] 

= PA [T>t | s t eAT t ], 

where here also the last equality is a consequence of lemma 7.6.11. Hence 

su P p^ [r>i] <P Ao [T>t\s t eM] 

which finishes to establish the first part of the lemma. Furthermore, note that the 
inequality 7.28 is an equality exactly when 

Pw \St £ \ a i* 7 maximizes P Ao [T > t\S t = cr]>\ = 1 . 

By Lemma 7.6.11, for t < t m ^ x (Ao), this happens exactly when P w [St G N't] = 1. □ 

Lemma 7.6.13 For every ir £ Prot(Prog ), for every t,t < t m ^ x (Ao), P Wo [St G 

Ai t ] = 1. 



Proof. Let ir £ Prot(Prog ). By Lemma 7.6.8, t m ^ x (Ao) = t min (ir ) = p — n + 1. 
Invariants g and h of Lemma 7.4.1 show that for every t,t < p — n + 1, 7r only 
selects ^-schedules in normal form. □ 

The next result expresses that, for all t, the protocols in Prot(Prog ) maximize the 
probability of survival up to time t when the adversary is the random adversary Aq. 

Corollary 7.6.14 For every ir £ Prot(Prog ), for every t, m&x w P wAo [T > t] = 

P,o,Ao[T>t]. 

Proof. The equality is trivially true if t > t m ^ x (Ao)'- in this case both terms of 
the equation are equal to 0. On the other hand, if t < t m ^ x (Ao), the equality is a 
direct consequence of Lemmas 7.6.12 and 7.6.13. □ 

We can finally provide the proof of Lemma 7.4.7, stating that 7r is optimal against 
adversary Aq. 
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Corollary 7.6.15 For every ir G Prot(Prog ), max w E WtAo [T] = E Wo>Ao [T\. 

Proof. Let ir be an arbitrary protocol in Prot(Prog ). By Lemma 8.1.2, for every 
protocol 7r, E WtAo [T] = Y^ t >i P Tr,Aa[ T > *]• Hence, 



sup E WtAo [T] = sup Y^ P 7r,A i T > f ] 

< ^su P p^ [r>i] 

t>i w 

= Y, P ^A [T>t] (7.29) 

t>i 

= E *o,Ao[ T ] ■ 

Equality 7.29 is a consequence of Corollary 7.6.14. □ 
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7.7 Aq is optimal against 7Tq 

This section is devoted to the proof of Lemma (7.4.8). It uses in detail the code 
describing Prog given in Page 151 to which the reader is referred. 

Notations: We use the convention established in page 156 and for each program 
variable X let X(t) denote the value held by X at the end of round t. Hence J(t) 
is the value held by the program variable J at the end of round t. Recall also that 
St(t) = St(t + 1) = . . . = S t (n — p + 1) so that we abuse language and let St also 
denote the value St(t) held by the program variable St at the end of round t. 

For every t, 1 < t < p — ra + 1 and every k, 1 < k < t, we let A k (t + 1) denote the 
value |Cfc(i)| — \C k (t + 1)|. As usual, we use lower-case to denote realizations of a 
random variable and write S k (t + 1) for a realization of A k (t +1). 

By invariants g, h and i given in Lemma 7.4.1, for every program prog in Prog , 
the value S k (t + 1) of A k (t + 1) is uniquely determined for given values of J(t) and 
J(t + 1), and hence for given values of S t and J(t + 1). 

Remember also that lA Ve (1) ( Ck (t)) denotes the uniform distribution on the set Vs h (t){c k {t)) 
of subsets of c k (t) which are of size S k (t). 

The next two lemmas, 7.7.1 and 7.7.2, characterize what is at each time t the 
probability distribution induced on V n (p) by the choice ^+1 made for round t + 1 
by a program in Prog . This distribution depends on the ^-schedule a selected by 
the program in the first t rounds and on the value allocated to J(t +1). 

As discussed in Section 7.4.4, J(t + 1) is an internal variable of the program and 
is not measurable in the probability space (£l,G) presented in Section 7.2. (In this 
space, only events describable in terms of the schedule Si, . . .,S P and in terms of the 
fault sequence i<\, . . .,F p are measurable.) To be able to measure probabilistically 
the values allocated to this variable we therefore need to use the probability space 
(0', Q' , -Pp r0 g) defined in Section 7.4.4. In a figurative sense, programs in Prog appear 
as black boxes when analyzed in the probability space (0,£/): this probability space 
allows only to measure the output (Si, . . . , S p ) of the programs. In contrast, the 
probability space (0',£/') allows to look inside each program prog in Prot(Prog ) 
and to analyze the internal actions it undertakes. 



Lemma 7.7.1 Let t, [p/n\ < t < p — ra + 1, be arbitrary, let prog £ Prog , let a be 
a t-schedule and J,J~C [t] such that P piog [St = o,J(t + 1) = J\ > 0. Then the 
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random variables S t+ i P\ c k (t), 1 < k < t are independent and such that 

P P ro S [s t+ i n c k (t) = ■ I s t = a,j(t + i) = j] = u Vsk(t+i)(Ck(t)) [ ■ ] , 

where S k (t + 1) and c k (t) are the values of A k (t + 1) and C k (t) uniquely determined 
by the conditions S t = a and J(t + 1) = J . 



Proof. Consider round t + 1, and let a denote the ^-schedule S t selected up to 
this point. 

Conditioned on S t = a, for every k,0 < k < t, the program variable C k is 
determined and equal to c k (t) - by definition of c k (t). Hence, in the randomized 
invocations S := unif orm(a; c K ) or S := uniform(o! + 1;ck) of lines 16, 22 and 35 
of the code of Prog , the variable C'k is equal to c K (t). Note also that no further 
change is brought in round t to a variable Ck once one of the lines 18, 24 or 37 is 
executed. Hence the value allocated to S in these invocations is equal to Ck (t + 1). 
These two facts imply that the randomized invocation of line 16 can be rewritten 
Ck{1 + 1) := unif orm(a; c K {t)), and that the randomized invocations of lines 22 
and 35 can be rewritten Ck (t + 1) := unif orm(a + 1; c K {t)). 

By invariant g of Lemma 7.4.1, the sets c k (t),0 < k < t form a partition of [p] and 
hence are disjoint. Hence the random draws associated to the various randomized 
invocations C'k (t + 1) := unif orm(a; c K {t)) and Ck (t + 1) := unif orm(a + 1; c K {t)) 
are independent and uniformly distributed. Therefore the random variables c k (t) — 
C k (t + 1), < k < t, are also independent of each other. 

The value J of J(t + 1) determines precisely what are the values of £;, 1 < k < t 
for which \Ck{1 + 1)| = ot + 1 and what are the values of £;, 1 < k < t for which 
\Ck{1 + 1)| = ot. After further conditioning on J(t + 1) = J , each random 
variable c k (t) — C k (t + 1), is drawn uniformly from the set Vs k ^+i)(c k (t)) of subsets 
of c k (t) which are of size S k (t + 1). (Recall that the value S k (t + 1) of A k (t + 1) is 
uniquely determined for the values a of S t and J of J(t + 1).) Hence, conditioned 
on {«S t = a, J{t + 1) = J}, the family (c (i) - C (t + 1), . . . , c t {t) - C t (t + 1)) is 
distributed according to the product distribution 



k = 



"Ps k (t + i)(ck(t)) ■ 



On the one hand, by invariant f of Lemma 7.4.1, the random set S t+ i is equal to 
the disjoint union yj\ =0 {c k (t) n S t +i). On the other hand, by construction, (see the 
code in Page 151), it is equal to the disjoint union U|_ (c fc (i) — C k (t + 1)). Hence, 



190 



Chapter 7. An Optimal Randomized Algorithm 



for all k, < k < t, c k (t) n S t+ i is equal to c k (t) — C k (t + 1). This (trivially) implies 
that the random variables c k (t) n St + i,Q < k < t, are independent and that, for 
every k,Q < k < t, c k (t) n S t+ i has the same distribution as c k (t) — C k (t + 1). In 
particular, for every k, < k < t, 



P pios [c k (t) n s t+1 = ■ | s t = a,j(t + i) = j] =u 7 



: 6 k (t + l)(ck(t)) 



D 



Lemma 7.7.2 Let t, [p/n\ < t < p — ra + 1, be arbitrary, let prog £ Prog , let a be 
a t-schedule and J,J~C [t] such that P piog [St = a, J(t + 1) = J\ > 0. Then 

t 

^4^+1= • |5 i = ( 7,j(ui) = j] = n^ (i+1 ,Mt))[ c ^) n •]> 

k = 

where S k (t + 1) and c k (t) are the values of A k (t + 1) and C k (t) uniquely determined 
by the conditions S t = a and J(t + 1) = J . 

Proof. 

P pios [s i+1 = - | S t = a, J(t + l) = j] 

= P pios [u t k=0 (c k (t)ns t+1 ) = u t k=0 (c k (t)n-) \s t = (T,j(t + i) = j] 

t 

= II P p- S [ C *W n 5 *+i = ( C *W ri ■)\s t = a,J(t+l) = j] (7.30) 



k = 

t 



n w \(« +1 )W))[ c *w n •] • 



(7.31' 



k = 



Equation 7.30 comes from the fact that the random variables c k (t) n S t +i are inde- 
pendent. Equation 7.31 is a direct consequence of Lemma 7.7.1. □ 

The next lemma is a simple consequence of the preceding ones and expresses what 
is the probability that the set next selected by a protocol in Prot(Prog ) does not 
contain an element already faulty. 

Lemma 7.7.3 Let t, [p/n\ < t < p — ra+1 and j, 1 < j < t be arbitrary. Let prog £ 
Prog , let a be a t-schedule and J, J C [t] such that P piog [St = a,J(t+l) = J\ > 0. 
Let fj £ Cj(t) be an arbitrary element. Then 

Pprog [ S t + 1 ^ fj St = <?, J(t + 1) = J J = U Vsi{t + 1)(Cj(t)) ['I fj\ ■ 
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Proof. Recall that for every k, S k (t + 1) and c k (t) are the values of A k (t + 1) and 
C k (t) uniquely determined by the conditions S t = cr and J(t + 1) = J . 

By invariant f of Lemma 7.4.1, St + i is equal to the disjoint union St + i = Ufc(5 , t+ i P\ 
c k (t)). By assumption, fj is in Cj(t). Hence fj is in S t +i if and only if it is in 
S t+ i fl Cj(t). This justifies the first following equality. The second one is a direct 
consequence of Lemma 7.7.1. Hence 

P plos [S t + l J fj \S t = (T,J(t + l) = j] 

= p prog [ (s t+1 n C] (t)) j ft \s t = (T, j(t + i) = j 

= ^V,( 1 + i)(C:,(t))[ ' If] \ ■ 

□ 

The following lemma is the crux of this section and reveals the role played by the 
uniform probability distributions used in the design of Prog . Particularly revelatory 
is the computation allowing to pass from Equation 7.36 to Equation 7.37. 

Lemma 7.7.4 Let t, 1 < t < p — ra + 1. Then the value of the probability 

P W0 [T>t + l | T>t,S t = (T,T t = (f>] 

is the same for all protocols ir £ Prot(Prog ) n , for all t-schedules a £ N't and for 
all t-fault-sequences <f> adapted to a such that P Wo \T > t, S t = a, T t = <f>\ > 0. 



Proof. Throughout the proof we consider 7r ,<7 and (f> such that P Wo [T > t,S t = 
o,J : t = 4>\ > and we let prog be an element in Prog such that 7r = vr prog . 

Recall that we let / l5 . . . , f t denote the realizations of i<\, . . . , F t . Hence the con- 
dition Tt = 4> means that (_F l7 . . . , F t ) is determined and equal to (/ l5 . . . , f t ) = (f>. 
Similarly, S t = cr means that the ^-schedule (Si,..., St) is determined and equal 
to (si, . . .,s t ) = a. The random sets Cj(u), 1 < j ' < u < t are then also uniquely 
determined and we let Cj(u) denote their realizations. Recall that, by Lemma 7.5.1, 
{T > t} = C\\ =l {F}; G Ck(t)}. Hence, by conditioning on {T ~>t,S t = o,Tt = <f\, 
we restrict ourselves to the case where f k is in c k (t) for every k, 1 < k < t. This 
fact, along with the fact that the family (c k (t))i <k<t is a partition of [p] implies that 
for every S, S C [p], and every k, 1 < k < t, the condition f k £ S is equivalent to 

f k e(Sr\c k (t)). 



See Page 150 for a definition of Prot(Prog ). 
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Case I. Assume that t < [p/n\ . Then P Wo \T > t + 1 T > t, S t = (T,J- t = <f>\ = 1 
and hence the result holds trivially. 

Case II. Assume that t > [p/n\ . We have: 



P* I T > t + 1 



T > t, S t = a, T t = 4> J 
P 1Co [s t+1 ^F 1 ,...,S t+1 ^F t | T>t, S t = a, T t = <f>] 
P Wo [ S t+1 $ /i , . . . , S t+1 $ f t T >t, S t = a, T t = ^ J 

P W0 [ (s t+1 n Cl (i)) ^ /i, • • • , (St+i n c t (i)) ? /* | T>t,S t = a,T t = ^.32) 
p. [ (s t+1 n Cl (*)) ^ A, . -.,(s t+1 n c t (i)) ? /, | S t = a] (7.33) 

£p prog [ (s t+1 n Cl (*)) ^ A, . ..,(s t+1 n c t (*)) ? /, | s t = a, j(t + i) = j] 

J 

■ P pios [j(t+l) = J\S t = a] 
t 
E II P p- S [ ( 5 *+i n C *W) ? /* \ S t = a, J(t + 1) = j] 

P pios [j(t+l) = J\S t = a] 
E II ^..wt^*)) [•?/*] P p- S [ J(i + 1) = J | «S t = a 



7.34) 



j - fc=i 



7.35) 
7.36) 



t 



n b |c 'i',^i" •ej'.-.[j('+i)=ji*H 

n*=i k*(*)i y 



7.37) 



(7.38) 



nLiic*wi 

Equation 7.32 stems from the fact that, as we saw at the beginning of this proof, 
for every k, 1 < k < t, fj. is an element of c k (t) and hence the condition S t+ i $ fk is 
equivalent to (S t+1 n c fc (i)) ^ / fc . 

We used in the beginning of the proof the formula {T > t} = C\\ =l {F k G Ck(t)}. 
We now find it convenient to use the alternate expression {T > t} = P\ t u=1 {S u P\ 
{Fi, . . .,F u _i} = 0}. (Both expressions are presented in Lemma 7.5.1). The event 
{T t = <f>, F > t} is equal to the event {T t = <f>, f]l =1 {S u l~l {fi, ■ ■ ., f u -i} = 0}} 
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which, when conditioned on S t = a, is itself equal to the event \Tt = (f>, f] u=1 {s u P\ 
{/i,...,/„_i} = 0}}- Note that the relation f]l =1 {s u l~l {fi, ■ ■ ., f u -i} = 0} only 
expresses a relation between the deterministic quantities s l7 / l5 . . ., s t . Hence the 
probabilistic event {T t = 4>, f] u= i{s u fl {fi, ■ ■ -, f u -i} = 0}} i s actually equal to 
{jF t = ^>}. As, by Lemma 7.3.1, conditioned on S t = a, the random variables T t and 
S t +i are independent, we therefore similarly have that, conditioned on S t = cr, the 
random variable S t +i is independent from the event \Tt = (f>, T > t}. This justifies 
Equation 7.33. 

In Equation 7.34, we condition on the value taken by J(t + 1), i.e., on the outcome 
of an internal action of the program prog associated to 7r . As discussed at the 
beginning of this section, the random variable J(t + 1) is not measurable in the 
(T-field associated to protocols, and we must therefore consider the probability space 
(Q,',Q',P piog ) allowing to measure the randomized invocations made by prog. This 
explains why we consider P piog in place of P Wo . 

By Lemma 7.7.1 the random variables S t +i fl c k (t), 1 < k < t are independent. This 
justifies Equation 7.35. Using Lemma 7.7.3 along with the fact that S t +i ^ fk is 
equivalent to (St + i P\ c k (t)) ^ f k justifies Equation 7.36. 

Note that we replaced in Equation 7.32 the conditions ^+1 ^ fk by the conditions 
(<5t + i fl Cfc(i)) ^ fk and that we replaced back each condition (St + i P\ c k {t)) ^ fk by 
St+i ~$ fk while establishing Equation 7.36. The reason for the introduction of the 
sets Cfc(i) is to be able to use the (conditional) independence of the random variables 
S t+ i fl Cfc(i) and to obtain the product introduced in Equation 7.35. 

Recall that we defined S k (t + 1) to be equal to the value |c fc (i)| — \c k (t + 1)|- Hence 
Uv 6k(t+1) (c k (t))[fk & ■] is equal to ^r lck(t+1)l (c k (t))[fk G •] which is equal to \c k (t + 
l)|/|cj;(i)|. This establishes Equation 7.37. Note that, for each k, the value c k (t-\- 1) 
does depend on the values a and J taken by St and J(t + 1). Nevertheless, by 
Lemma 7.4.5, the product Ylk=i \ c k(t + 1)1 (resp. Ylk=i l c fc(OI) 1S ^ e same f° r an 
programs prog £ Prog and all values a, J and (f> taken by St, J(t + 1) and T t . 
We can therefore factor the term Y\k=i \ c k{t + l)|/llfc=i l c fc(OI ou ^ °f the summation 
over J . This justifies Equation 7.38. 

This establishes that P Wo [T > t -\- 1 | T > t, S t = cr, J- t = (f>] is the same for 
all protocols 7r G Prot(Prog ), all ^-schedules a £ N't and all i-fault-sequences (f> 
adapted to a. D 

Note that if k < [p/n\ then c k (u) = S k for all times u,k < u < [p/n\. Therefore 
\c k (t + l)\/\c k (t)\ = 1 for all i and k, 1 < k < t < [p/n\ . 

Assume now that t > p — n + 1. Let a be a ^-schedule and let s G V n {p) be such 
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that (it, s) is a t-\- 1-schedule. Let 7r be a protocol in Prot(Prog ) n P generating (a). 
By Lemma 7.6.8, i max (.4o) = p — ra + 1. By definition of t m ^ x (Ao) this implies that 
Pa [T — ^ + 1 I St+i = ( ,T ? S )] = and by consequence that (a, s) G - Feas^ . Hence, 
as is established at the beginning of the proof of Lemma 7.6.10, n,=i \ c j(t + 1)1 = 
0. Using the convention 0/0 = (see Convention 8.1.1, page 198) we see that 
(rifc=i \ c k(t + l)l)/(l~lfc=i l c fc(0l) = 0- O n the other hand, again by Lemma 7.6.8 and 
Convention 8.1.1, P^T > t + 1 | T > t, S t = a, T t = cf>] = if t > p - n + 1. 

This shows that the equality 

PjT>t+l T>t,S t = a^ t = ( f>} = Ul =} lc f+] )l 

1 J n*=i k*(*)i 

holds for every t,t > 1. 

This result, along with Formula 7.13 in Lemma 7.6.10 establishes the following 
remarkable fact: 12 



For every t,t > 1, every t + 1-schedule (cr,s) G A^+i, every i-fault-sequence (f> 
adapted to a and every protocol 7r G Prot(Prog ) n P generating (^a): 



P Ao [T>t + l | T>t,S t+1 = ((T,s)] 
= -rr\c J (t + l)\ 



. i ki(*)l 

p. [r>i + i | r>i, 5 t = CT,^ t = 0] 



where the values c,-(i), 1 < j < t, and Cj(t +l),l<j<i, are the c- values related to 
the (t + l)-schedule (a, s). 

This result constitutes the core technical result of this chapter, whose consequences 
ultimately lead to the fundamental equality 

sup E WiAo [T] = E WoAo [T] = inf E WoA [T] , 
establishing Theorem 7.4.6. 

Lemma 7.7.5 Let t,l < t < p — n + 1. Then, for every ir G Prot(Prog ), the 
probability P Wo ^[T >t-\-l\T>t] is independent of the adversary A. 



"Recall that, by convention, we set 0/0 = 0. 
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Proof. 

P, ,A\T>t + l 



T >i] 



J2 P -o[T>t+l \T>t,S t = (T,T t = (f>] P 1COtA [s t = (T,T t = (f>] 

T > t, S t = a, F t = cf>] J2 P «°A St = ^ = 4 7 - 39 ) 

T > t, S t = a, T t = ^J 



(7,</> 



P. I T > t + 1 



a,(p 



P* \T>t+l 



Equation 7.39 holds because, by Lemma 7.7.4, the value P Wo [ T > t + 1 | T > 
i, (5 t = (7, T t = (f>] is the same for all a and (f> (adapted to a). Furthermore, the 
fact that the value P Wo [ T > t + 1 | T > t, S t = 0, T t = <f>] does not depend on 
(f> immediately implies that it similarly does not depend on A, which concludes the 
proof. □ 

Lemma 7.7.6 Let t,l < t < p — n + 1. Then, for every ir £ Prot(Prog ), the 
probability P WOtA [T > t] is independent of the adversary A. 

Proof. P n0tA [T >t} = P n0tA [T >t\T>t-l}. ..P n0tA [T > 2 | T > 1]. The result 
then follows from Lemma 7.7.5. □ 

We are now finally able to prove Lemma (7.4.8). 

Corollary 7.7.7 For every ir £ Prot(Prog ), the expectation E WOiA [T] is indepen- 
dent of the adversary A. 



Proof. 



E* ,a[T] = J2 P ^AT>t] 
t>i 

imax(i) 

= E P*oAT>t] 

t = l 

*min(*"o) 

= E P«oAT>t] 



(7.40) 



(7.41) 



(7.42) 



Equality 7.40 is justified by Lemma 8.1.2. Equality 7.41 by the fact that P WOtA [T > 
t] = if t > £ max (.4). By Lemma 7.6.8, for all A, t m!LX (A) = t^^iro) = p — n+1. This 



196 Chapter 7. An Optimal Randomized Algorithm 

justifies Equality 7.42. By Lemma 7.7.6, for every t, 1 < t < t min (ir ), each of the 
terms P^ 0t ^[T > t] is independent of A. Hence the whole sum J2t=T P-ji ,a\^ — t] 
is independent of A. D 



Chapter 8 



General Mathematical Results 



8.1 Some Useful Notions in Probability Theory 

Notation: 1) For every finite set $, $ ^ 0, we let U® denote the uniform distribution 
of the set $. We will find it convenient to extend this definition to $ = and let 
Uq(A) be identically equal to for every set A. (Hence 14$ is not a probability 
distribution.) 

2) For every set X we let V{X) denote the power set of X . For every integer 8 we 
let Vs(X) denote the set of subsets of X of size 8: 

V f (X) = {Y CX;\Y\ = 8}. 

Hence, Vq{X) = {0} and Vs(X) = for all 8 > |X|. To simplify the notations we 
write V n {p) in place of V n {{N]). 

3) For every integers k and /, k < /, we let [/] denote the set {1,...,/} and let 
V k (l) = {s;sC[l],\s\ = k}. 



We can mix the two previous definitions and consider U-p s (x)i the uniform distribu- 
tion on Vs(X). The following lemma investigates some special cases associated to 
this situation. 

Lemma 8.1.1 1) U-p s (x) = if 8 > \X\. 2) U-p (x) = H? ^ e Dime measure on 0. 
Equivalently, lA Vo ( X ) is the probability measure selecting the empty set with probability 
1. 

Proof. Assume that 8 > \X\. Then, for every set A, U T6 ( X ){A) = Um(A) = 0. On 
the other hand, lA Vo ( X ) = ^{0} is the uniform distribution on the singleton set {0}, 
i.e., the distribution selecting with probability one. □ 
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Convention 8.1.1 Let (£l,Q,P) be some probability space. For all A and B in Q 

we set P\B\A\ = whenever P[A] = 0. We accordingly set to the ratio 0/0. 

Definition 8.1.1 Let (£l,Q,P) be a probability space. For every sets A and B in 
Q we say that A and B are P -equivalent if P[AAB] = 0, where AAB denotes the 
symmetric difference of A and B . An element A of Q is called a P-atom if, for 
every B in Q , B is a subset of A only if B is P -equivalent to A or to 0. 

Definition 8.1.2 Let (O l5 Q x , Pi) be some probability space and let X : (fii,£/i,-Pi) — ► 
(S7 2 ? ^2) be a random variable. Then the law of X is the probability distribution on 
(£l 2 ,Q 2 ) defined by: 

VBeQ 2 , P 2 [B] = p 1 [XeB}. 

We write 

C(X) = P 2 . 

For A G Q\, P[A] ^ 0, the random variable X\A is by definition a random variable 
X' whose law P 3 is given by: 

vb e g 2 , p 3 [b\ = a[x' g b] 

d ^ p,[x eB\A\. 

Following Convention 8.1.1, we set X\A = if P[A] = 0. 

Lemma 8.1.2 Let T be any non-negative random variable defined on some proba- 
bility space (£l,Q, P). Then 

/•OO 

E[T] = P[T > t] dt . 
Jo 

If T is integer valued, the preceding translates into 

00 
E[T] = Y,P[T>t]. 



Proof. For every interval [0,T[ we let X[o,t[ denote the function equal to 1 on 
[0,T[ and elsewhere. Also, for simplicity of notation, we think of the expectation 
E as being an operator and let Ef denote E[f]. 

ET = E I dt (8.1) 

Jo 
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E / X[o,T[(t)dt 
Jo 

/>oo 

dP(x) / xio,T(*)i(t)dt (8.2) 

Jo 

dt J dP(x) X[ o,T( x )[(t) (8.3) 

X) 

p[r >t]dt. 



Equation 8.1 comes from the simple observation that T = J dt. Equation 8.2 is 
a particular case of the general formula E[f] = J f(x)dP(x). Equation 8.3 is an 
application of Fubini's theorem. In the case where T is integer valued, 



/•OO 

E[T] = / P[T > t] dt 
Jo 

f" 
= Y, P[T>t] dt 

n = l"' n - 1 



□ 

The following lemma states a well-known property of the uniform distribution. 

Lemma 8.1.3 Let A be a finite set and let B be a non empty subset of A. Then 
Ua\ ■ | B] = U AnB - 

Lemma 8.1.4 Let (0,£/,P) be some probability space, let S : ($l,G) — ► (E,V(E)) 
be a random variable defined on S7. Then for every B £ Q, 

P[B] < maxP[5 | S = s]. 

Proof. V(E) being the u-field attached to E the set {S = s} is measurable for 
every s in E. Hence P[B \ S = s] is well-defined if P[S = s] ^ 0. On the other 
hand, by Convention 8.1.1, P[B \ S = s] is set to when P[S = s] = 0. Hence 
P[B | S = s] is well-defined for all s m E. 

P[B] = J2 P i B \ S = s ] p i s = s ] 



seE 
mas 

s£E 



< m&xP[B \ S = s]J2 p [S 
seE 



maxP[5 I 5 = 5]. 

s£E 



a 
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Lemma 8.1.5 Let B and A be any real-valued random variables. Then 
\fx G R, P[B > x | B < A] < P[B > x]. : 

Proof. The result is obvious if P[ B < A ] = 0. We can therefore restrict ourselves 
to the case P[B < A] > 0. Assume first that A is a constant a. 

If a < x the result is trivially true, so we assume that a > x. Set p = P[B > a] and 
fi = P[B > x]. Then: 



P[B>x\B<a] = agffl 
For fi G [0, 1], The function <j)p is not increasing on [0, 1). Hence: 



P[B > x | B < a] < (f> p (0) 

= P[B>x]. 

We then turn to the case where A is a general random variable. 2 We will let dP A 
denote the distribution of A so that, for any measurable set U, dP A [U] = P[A G U]. 
Then: 



P[A>B>x] = f P[a>B >x]dP A (a) 

•J a 

= f P[B >x\B <a] P[B <a]dP A (a) 

•J a 

< f P[B > x] P[B < a] dP A (a) 

J a 

(We use here the result valid for A = a constant) 

= P[B >x]f P[B < a] dP A (a) 

•J a 

= P[B > x] P[B < A] . 
Then we just need to divide by P[B < A] to get the result we are after. □ 



Recall that, using Convention 8.1.1, we set 0/0 = whenever this quantity arises in the com- 
putation of conditional probabilities. 

Note that we cannot simply extend the previous proof in this case: A can sometimes be less 
then x and then it is not true anymore that {B > A} C {x < B}. We used this when saying that 
P[x < B < a] = P[x < B] - P[B > a]. 
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If A is a discrete variable, its distribution is absolutely continuous with respect to 
the counting measure, so that the expression f P[a > B > x\dP A (a) reduces to 

J2a P [ a > B > X } P [ A=a }- 

We recall in the following definition the notion of stochastic (partial) ordering: this 
ordering is defined within the set of real random variables. 

Definition 8.1.3 Let X and Y be two real random variables. Then the following 
conditions are equivalent: 

1. For all x e R, P[X > x] < P[Y > x]. 

2. For all continuous and bounded function f, f(x)dPx(x) < I f[x)dPy(x) 
(i.e., dP x < dP Y ). 

We then say that the X is stochastically smaller then Y (or alternatively smaller in 
law,) and we write that: X < c Y . 

Note that if X < Y in the usual sense (i.e., almost surely), then X is also stochasti- 
cally smaller then Y . Actually, among all the usual orders that are usually consid- 
ered on the set of random variables (e.g., almost surely, for some i p -norm, for the 
essential norm L°°) the stochastic ordering is the weakest. 

Formulated in this language, Lemma 8.1.5 just says that 

(B \ B < A) < c B. 

The result of Lemma 8.1.5 can be generalized into: 

Lemma 8.1.6 Let A x , A 2 and B be any real-valued random variables. 3 Assume 
that Ax <c A 2 . Then 

(B\B<A 1 )< C (B\B< A 2 ). 

Proof. The proof is similar to the one of Lemma 8.1.5. (Lemma 8.1.5 corresponds 
to the case A 2 = oo.) □ 

Lemma 8.1.7 Let A, B and C be any real-valued random variables. Then 

P[B > C | B < A] < P[B > C]. 



As is customary in measure theory, we allow the random variables to take the oo value. 
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Proof. We integrate the inequality of Lemma 8.1.5: 

P[B >C \B < A]= I P[B >x\B < A] dP c {x) 
< I P[B > x] dP c (x) = P[B > C]. 

□ 

Lemma 8.1.8 Let A x , A 2 and B be any real-valued random variables. Assume 
that Ax <c A 2 . Then 

P[A! > B]< P[A 2 > B]. 

Proof. P[Ai > B] = f P[Ai > x] dP B (x) < I ' P[A 2 > x] dP B (x) = P[A 2 > B]. 
D 



8.2 Max-Min Inequalities 

Lemma 8.2.1 Let f(x, y) be a reel function of two variables defined over a domain 
1x7. Then 

sup inf. f(x, y) < inf. sup f(x, y). 

x£xy£ Y y£ Y xex 

Proof. Let x and y be two arbitrary elements in X and Y respectively. Obvi- 
ously, f(x , yo) < SU P X f( x > Vo)- This inequality is true for every y so that inf y f(x , y) 
< mfy sup,,, f(x, y). Note that inf y sup^, f(x, y) is a constant. The last inequality is 
true for every x so that sup^ inf y f(x , y) < inf y sup^ f(x, y). D 

Lemma 8.2.2 Let f(x, y) be a reel function of two variables defined over a domain 
X xY. For every x £ X and y £ Y we have inf^gy f(x , y) < snp x£X f(x,y ). 
Furthermore, the previous inequality is an equality only if 

max inf f(x, y) = min sup f(x, y) = f(x , y )- 

x£X y£Y y£Y xeX 



Proof. 



inf f(x ,y) < sup inf f(x,y) 
y£ Y x£xy£ Y 



< inf sup f(x, y) (by Lemma 8.2.1) 

y£ Y x£X 

< swpf(x,y ). 

x£X 
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If inf^gy f(x , y) = snp x£X f(x,y ) the previous inequalities are equalities so that 
inf yeY f( x 0i y) = su Pj;6x m ^yeY f(x, y). This shows that the previous sup is achieved 
(for x = x ) and hence that sup^^ inf^gy f(x, y) = max ie x inf^gy f(x, y). Simi- 
larly inf^gy sup^g^y f(x, y) = min^gy sup^g^^ f(x, y). To finish, note that, obviously, 
inf^gy f(x , y) < f(x ,y ) < swp x€X f(x,y ). Hence the equality infygy f(x , y) = 
su Vxex f(x,Vo) occurs only if max xeX mf yeY f(x,y) = mm yeY sup xeX f(x, y) = 
f{x ,y ). D 

The following result strengthens the preceding one. 

Proposition 8.2.3 Let f(x,y) be a reel function of two variables defined over a 
domain X xY. Define Oi = {x 1 G X; inf^gy f(x',y) = sup.j,g X inf^gy f(x,y)} and 
similarly 2 = {y' G Y; sup^g^^ f(x,y') = inf^gy sup^g^^ f(x,y)}. Then there exists 
x G X and y G Y such that 



if and only if 



mif(x ,y) = sup f(x,y ) 

y£ Y xex 



max inf f(x, y) = min sup f(x, y). 

xex yeY yeY xeX 



Furthermore, if this condition is satisfied, Oi and 2 are both non-empty and for 
every x G Oi and every y G 2 we have 

inf /Oo, y) = sup f(x, y ) = f(x , y ) = max inf f(x, y) = min sup f(x, y) . 

y x x£X y£Y y eY x£X 

Proof. By Lemma 8.2.2, there exists x G X and y G Y such that 

inf f(x ,y) = sup f(x,y ) 
y£ Y xex 

only if max^gx inf ye y f( x , y) = min^y sup^g^^ f(x, y). Conversely assume that 
max^gx inf^gy f(x, y) = min^gy sup^g^^ f(x, y). Part of the assumption is that 
sup^gx inf^gy f(x, y) = max ie j inf^gy f(x, y) which means that Oi is non-empty. 
Symmetrically, 2 is non-empty. Let x and y be any two elements of Oi and 2 
respectively. By definition, inf y f(x , y) = max ie j inf^gy f(x, y) and sup,,, f(x, y ) = 
min^gy sup^g^y f(x, y). By assumption these two values are equal so that inf y f(x , y) 
= sup^, f(x,y ). By Lemma 8.2.2, this common value is equal to f(x ,y ). □ 

Lemma 8.2.4 Let X and Y be two sets such that for every (x,y) G X X Y, 
(a xy (t)) is a sequence of non-negative numbers. For every x G X we define 

tmin(x) = sup {t; mia Xy y(t) > }. 
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Similarly, for every y £Y we define 

^max(y) d = sup {/; sup a Xty (t) > 0}. 

X 

Then 

supi min (a:) < inf i max (f/) . 

x y 



def 



Proof. Define Y' to be the set Y' = {y G Y; i max (y) < oo}. The result is obvious if 
^max(y) = °o f° r every y E.Y. We therefore consider the case where i max (y) < oo for 
some y in Y, i.e., when Y' is non empty. Furthermore, the equality inf^gy i max (y) = 
infygy i max (y) shows that we can restrict our analysis to within Y' in place of Y. Let 
2?i and y! be two arbitrary elements from X and Y' respectively. The definition of 
^max(yi) implies that a XltVl (i max (f/i) + l) = and hence that inf y a Xl>y (i max (f/i) + l) = 
0. By definition of t min (xi) this implies that i min (a; 1 ) < i max (2/i). The elements Xi and 
2/i being arbitrary, we obtain that 

supi min (a:) < inf i max (y). 

x y 

By assumption, all the numbers a xy (t) are non-negative and inf y i max (y) < oo so 
that < sup,,, i m i n (a;) < inf y i max (y) < oo. The inequality sup^ i min (a;) < oo shows 
that sup^ t min (x) = maXj t min (x). Similarly, the inequality < inf y i max (y) implies 
that infj, i max (y) = min,, i max (y). Therefore, in the case where i max (y) < oo, the 
max-min inequality can be strengthened into 

< mini max (y). 

□ 



8.3 Some Elements of Game Theory 

Recall that, for all column vector X , X T denotes the transpose of X. For any integer 
k we let T k denote the £;- dimensional fundamental simplex and 7^' denote the set of 
extreme points of this simplex: 

r i d = f {(A 1 ,...,A„)G[0,ir;X)A,- = l}. 

i 

r,' d = f {(i,o,...,o),(o,i,...,o),...,(o,o,...,i)}. 

The following theorem is the celebrated result of Von Neumann which initiated the 
field of game theory. 
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Theorem 8.3.1 (Von Neumann) For any k X / real matrix M = (Mij)ij, the 
equality 

m&xmm X T MY = mm m&xX T MY 

X€T k Y£T, Y£T, X£T k 

is valid. Furthermore, this common value is equal to: 

maxminX T MY and mmma,xX T MY. 

x € T k Y£T{ Y£T, X£T^ 

Note that, (X,Y) — ► X T MY is continuous on the compact T t X 7j. Hence for 
every X we can find an element Y x in % such that mi Y £T k X T MY = X T MY X . 
Furthermore we easily check that we we can select Y x in such a way that X —^ Y x 
defines a continuous function on T k . This immediately implies that 

sup inf X T MY = sup X T MY X 

x £ r k Y€T, X£T k 

= max X T MY x 

X€T k 

= max min X T MY . 

x £ T k YZT, 

We similarly easily establish that inf sup xgT X T MY = min YgTi max X€Tfc X T MY. 
Note also that the inequality sup x inf Y X T MY < infy sup x X T MY is a direct 
consequence of Lemma 8.2.1. A proof of the converse can easily be derived with the 
use of the duality result in Linear Programming. 

The game theory interpretation of this result is as follows. Consider two players 
Player(l) and Player (2) involved in a game (G, II, A) with a performance function 
/. G is the set of rules of the game describing how the game is played between the 
two players, which actions (and in which order) are to be undertaken by the players 
and in particular which information is traded between the two players during the 
execution of a game. II is the set of allowable strategies of Player(l), A is the set of 
allowable strategies of Player (2): II (resp. A) is a subset of the set of strategies of 
Player(l) (resp. Player (2)) compatible with the rules of the game G. Note that, by 
definition, a strategy of either player is defined independently of the strategy chosen 
by the other player. /:IIxA^]Risa performance function measuring "how well" 
a given strategy it of Player(l) does when implemented again a given strategy A 
of Player (2). We assume that the game is a zero-sum noncooperative game which 
means that one of the two players, say Player(l), wants to chose its strategy so as 
to maximize the performance f(ir,A) and that the other player, Player(2), wants 
to chose its strategy so as to minimize the performance. 

We consider the sequential case where one player chooses first a strategy and where 
the other player then chooses his. Hence, if Player(l) plays first, for every e > 0, 
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the two competing players can choose their respective strategies it and A so as to 
bring f(ir,A) to within e of snp n mf^ f (it, A). Conversely, if Player(2) plays first, 
for every e > 0, the two competing players can choose their respective strategies it 
and A so as to bring f(ir,A) to within e of mf^snp n f (it, A). By Lemma 8.2.1, 

supinf f(ir,A) < inf sup/(7r,.4), (8.4) 

which expresses that, for either player, selecting its strategy last can only be benefi- 
cial. Generally, the inequality is strict, i.e., there is a definite advantage in choosing 
its strategy last. 

An interpretation of this inequality is that, eventhough no explicit exchange of in- 
formation is performed between the two players when they select their respective 
strategies, the player selecting its strategy last can be assumed to know the strat- 
egy selected by the player selecting its strategy first. The reason for it is that, for 
every given choice it made by Player(l), there is a Player(2) that "always assumes" 
that Player(l) chooses it and that makes an optimized decision A based on this 
assumption. Such a Player(2) is by construction optimal if Player(l) does chose it. 
Based on this remark we say that an optimal Player(2) knows implicitly the iden- 
tity of Player(l) in the expression snp n mf^ f (it, A). Symmetrically, we say that 
an optimal Player(l) knows implicitly the identity of Player(2) in the expression 
inf^sup 7r /(7r,yl). 

In this setting, the strict inequality in Equation 8.4 expresses precisely that allocat- 
ing to one or the other player the possibility of spying on the competitor's strategy 
affects the performance of the game. This interpretation of Inequality 8.4 will be 
very useful in the rest of the discussion. 

Consider now the case where Player(l) is provided with a set / of size k and 
Player(2) is provided with a set J of size /. Assume that to each pair (i,j) in I X J 
is associated a cost Mij in KL Let ((G, II, A), /) be a game with a performance func- 
tion where II = /, A = J, f(i,j) = Mij and where the rules are the trivial rules: "do 
nothing". In the case where Player(l) and Player (2) both choose their strategies 
optimally and where Player(l) chooses first, the performance associated to the game 
is max, minj Mjj. Conversely, if Player (2) plays first, the performance associated 
to the game is min,- max, M 8J '. As discussed above, max, min,- M 8J ' < minj max, M 8J ' 
and, generally, the inequality is strict, i.e., there is a definite advantage in making 
its choice last. 

We consider now the case where the players are allowed to make random choices. 
The following theorem formalizes the fact that, in a game of cards played by two 
players, knowing the opponent's strategy confers no advantage for winning any single 
hand, provided that the hand finishes in a bounded number of transactions. 
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We abuse language and identify a probability distribution with the procedure con- 
sisting of drawing an element at random according to this probability distribution. 

Theorem 8.3.2 Consider a two-players game (G,IL,A) having the property that 
there exists two finite sets I and J such that II is the set of probability distributions 
on I and such that A is the set of probability distributions on J. Let T be a function 
on I X J . (T is often called the cost function.) For every it in II and every A in 
A we let E W ^[T] denote the expected value of T when Player(l) selects an element 
in I according to the distribution it and when Player (2) selects an element in J 
according to the distribution A. Then 

max min E w * \T\ = min max E w * \T\ . 
vren AtA •■ Al i AtA wen ' Ay J 

The sets / and J are often called the set of pure strategies. The sets II and A are 
often called the set of mixed strategies. 

Proof. A probability distribution on / is represented by a &-tuple (A l7 . . . , X k ) of 
non-negative numbers summing up to one. Equivalently, T k is the set of probability 
distributions on / and similarly % is the set of probability distributions on J. By 
assumption II can be identified to T k and a strategy it in II can be represented by 
element X in T k . Similarly, A can be identified to % and a strategy A in A can be 
represented by element Y in %. For every (i,j) £ I X J we write M 8J ' = T(i,j) and 
we let M represent the associated matrix: by construction M is symmetric. Using 
these associations, consider the case where Player(l) chooses the strategy X £ T k 
and where Player (2) chooses the strategy Fglj. The quantity X T MY represents 
the expected value of the cost T obtained under these strategies. Theorem 8.3.2 is 
therefore a direct application of Theorem 8.3.1. □ 

A game as one described in Theorem 8.3.2 is is often called a matrix game. 



Explicit/Implicit knowledge. In the course of the previous discussion we intro- 
duced the notion of implicit knowledge. We present here an abstract summarizing 
this concept. 

We say that a player, say Player (2), receives explicitly some information x during 
the course of an execution when the rules of the game (i.e., when considering al- 
gorithms, the II/A-structure) specify that that Player (2) be informed of x. We 
can say figuratively that Player (2) "receives a message" carrying the information x. 
Note that, in this situation, Player (2) receives the information x independently of 
the strategy that it follows. 
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Consider now a function of two variables f(x,A), (x,A) G X X A and consider the 
expression inf^ f(x, A). We can consider this situation as a game parameterized 
by x played by Player (2): Player (2) tries to decide A so as to minimize f(x,A). 
Eventhough there might be no mechanism letting Player (2) explicitly know what 
the parameter x is, when considering the expression mij( f(x,A) we can assume 
that an optimal (and lucky) Player(2) selects non-deterministically an A bringing 
the function f(x,A) arbitrarily close to inf^ f(x,A): we then say that an optimal 
Player(2) knows implicitly the parameter x selected. This knowledge is not a real 
knowledge and is of course nothing more then a heuristic meaning that some choice 
of A corresponds ("by chance") to the choice that some informed Player(2) would 
make. Note that, in contrast to the case of explicit knowledge, Player(2) is said to 
"have the implicit knowledge" when it chooses a "good" strategy A. 

We provide two examples of this situation. When considering the formula 

sup inf ' f(ir,A) 

we will say that Player(2) knows implicitly the value it. Also when considering the 
formula 

inf P A [C\B] 

we will say that Player(2) knows implicitly that the sample space is restricted to 
within B. 



Bibliography 



[9 
[10 



N. Alon and M. Rabin. Biased coins and randomized algorithms. Advances in 
Computing Research, J AI Press, 5:499-507, 1989. 

R. Alur, C. Courcoubetis, and D. Dill. Model checking for probabilistic real- 
time systems. In Proceedings 18* ft Int. Coll. on Automata Languages and Pro- 
gramming (ICALP), 1991. 

J. Aspnes and M. Herlihy. Fast randomized consensus using shared memory. 
Journal of Algorithms, 15(l):441-460, September 1990. 

J. Aspnes and 0. Waarts. Randomized consensus in expected o(ralog n) oper- 
ations per processor. In 33 rd Annual Symposium on Foundations of Computer 
Science, 1992. 

H. Attiya and M. Snir. Better computing on the anonymous ring. Journal of 
Algorithms, 12:204-238, 1991. 

J. P. Aubin. Mathematical Methods of Game and Economic Theory. North- 
Holland Pub. Co., Studies Mathematics and its Applications, 1982. 

Y. Azar, A. Broder, and A. Karlin. On-line load balancing. In 18* ft Annual 
Symposium on Foundations of Computer Science, Providence, Rhode Island, 
pages 218-225, 1992. 

A. Benveniste, B. Levy, E. Fabre, and P. LeGuernic. A calculus of stochastic 
systems: their specifications, simulation, and hidden state simulation. Tech. 
Rep. 606-Irisa-France, 1994. 

A. Benveniste, M. Metivier, and P. Priouret. Adaptive Algorithms and Stochas- 
tic Approximations. Applications of Mathematics. Springer Verlag, 1990. 

P. Billingsley. Convergence of Probability Measures. Wiley Series in Probability 
and Mathematical Statistics. John Wiley, 1968. 

209 



210 Bibliography 

[11] A. Blum and P. Chalasani. Learning switching concepts. In COLT 92, 1992. 

[12] J. Burns, M. Fischer, P. Jackson, N. Lynch, and G. Peterson. Data requirements 
for implementation of n-process mutual exclusion using a single shared variable. 
Journal of the ACM, 29(l):183-205, January 1982. 

[13] B. Chor and C. Dwork. Randomization in byzantine agreement. Advances in 
Computing Research, JAI Press, 5:443-498, 1989. 

[14] S. Cohen, D. Lehmann, and A. Pnueli. Symmetric and economical solutions to 
the mutual exclusion problem in a distributed system. Theoretical Computer 
Science, 34:215-225, 1984. 

[15] S. Ben David, A. Borodin, R. Karp, G. Tardos, and A. Widgerson. On the power 
of randomization in online algorithms. In Proceedings of the 22 nd Annual ACM 
Symposium on Theory of Computing, pages 379-386, 1990. 

[16] E. W. Dijkstra. Solution of a problem in concurrent programming control. 
Communications of the ACM, pages 643-644, 1966. 

[17] P. Feldman and S. Micali. Optimal algorithms for byzantine agreement. In 
Proceedings of the 20* ft Annual ACM Symposium on Theory of Computing, 
pages 148-161, 1988. 

[18] Y. Feldman. A decidable propositional probabilistic dynamic logic. In Proceed- 
ings of the 15* ft Annual ACM Symposium on Theory of Computing, Boston, 
Massachusetts, pages 293-309, 1983. 

[19] M. Fischer and L. Zuck. Reasoning about uncertainty in fault-tolerant dis- 
tributed systems. In Proceedings of the 1988-Annual Symposium on Formal 
Techniques on Real Time and Fault Tolerant Systems, pages 142-157, 1988. 

[20] P. Flajolet and N. Martin. Probabilistic counting algorithms for data base 
applications. Journal of Computer and System Sciences, 31:182-209, 1985. 

[21] N. Francez and M. Rodeh. A distributed data type implemented by proba- 
bilistic communication scheme. In 21 s * Annual Symposium on Foundations of 
Computer Science, Syracuse, New York, pages 373-379, 1980. 

[22] R. Gawlick, R. Segala, J.F. S0gaard- Andersen, and N. Lynch. Liveness in timed 
and untimed systems. Technical Report MIT/LCS/TR-587, MIT Laboratory 
for Computer Science, November 1993. 



Bi bliography 211 

[23] R.J. van Glabbeek, S.A. Smolka, B. Steffen, and C.M.N. Tofts. Reactive, gen- 
erative, and stratified models of probabilistic processes. In Proceedings of the 
5 th Annual Symposium on Logic in Computer Science, pages 130-141, 1990. 

[24] M. Goemans, N. Lynch, and I. Saias. Upper and lower bounds on the number 
of faults a system can withstand without repairs. In Proceedings of the 4 th IFIP 
Working Conference on Dependable Computing for Critical Applications, San 
Diego, California, 1994. 

[25] R. Graham and A.C.-C. Yao. On the improbability of reaching byzantine agree- 
ments. In Proceedings of the 21 s * Annual ACM Symposium on Theory of Com- 
puting, Seattle, Washington, pages 467-478, 1989. 

[26] R. Gupta, S. Smolka, and S. Bhaskar. On randomization in sequential and 
distributed systems. ACM Computing Surveys, 26(l):7-86, 1994. 

[27] H. Hansson. Time and Probability in Formal Design of Distributed Systems. 
PhD thesis, Department of Computer Science, Uppsala University, 1991. 

[28] S. Hart and M. Sharir. Proceedings of the 16* ft annual acm symposium on 
theory of computing, Washington, d. c. In Probabilistic Temporal Logics for 
Finite and Bounded Models, pages 1-13, 1984. 

[29] S. Hart, M. Sharir, and A. Pnueli. Termination of probabilistic concurrent pro- 
grams. ACM Transactions on Programming Languages and Systems, 5(3):356- 
380, 1983. 

[30] C.A.R. Hoare. Communicating Sequential Processes. Prentice-Hall Interna- 
tional, Englewood Cliffs, 1985. 

[31] J.E. Hopcroft and R.M. Karp. A n 5 ^ 2 algorithm for maximum matching in 
bipartite graphs. SI AM Journal on Computing, 2:225-231, 1973. 

[32] C.C. Jou and S. Smolka. Equivalences, congruences and complete axiomatiza- 
tions for probabilistic processes. In Proceedings of CONCUR, 1990. 

[33] A. Karlin and A. Yao. Probabilistic lower bounds for byzantine agreement. 
Unpublished document. 

[34] H. W. Kuhn and A. W. Tucker. Contributions to the Theory of Games. Annals 
of Mathematics Studies 24. Princeton University Press, 1950. 

[35] E. Kushilevitz, Y. Mansour, M. Rabin, and D. Zuckerman. Lower bounds 
for randomized mutual exclusion. In Proceedings of the 25* ft Annual ACM 
Symposium on Theory of Computing, pages 154-163, 1993. 



212 Bibliography 

[36] E. Kushilevitz and M. Rabin. Randomized mutual exclusion algorithms re- 
visited. In Proceedings of the ll* ft Annual ACM Symposium on Principles of 
Distributed Computing, Quebec, Canada, pages 275-284, 1992. 

[37] D. Lehmann and M. Rabin. On the advantage of free choice: a symmetric and 
fully distributed solution to the dining philosophers problem. In Proceedings 
of the 8 th Annual ACM Symposium on Principles of Programming Languages, 
pages 133-138, January 1981. 

[38] D. Lehmann and S. Shelah. Reasoning with time and chance. Information and 
Control, 53:165-198, 1982. 

[39] L. Lovasz and M. Plummer. Matching theory. Annals of Discrete Mathematics, 
29. North-Holland, Mathematical Studies 121, 1986. 

[40] N. Lynch, I. Saias, and R. Segala. Proving time bounds for randomized dis- 
tributed algorithms. In Proceedings of the 13* ft Annual ACM Symposium on 
Principles of Distributed Computing, Los Angeles, California, pages 314-323, 
1994. 

[41] N.A. Lynch and F.W. Vaandrager. Forward and backward simulations - part II: 
Timing-based systems. Technical Report MIT/LCS/TM-487, MIT Laboratory 
for Computer Science, September 1993. 

[42] U. Mamber and M. Tompa. The complexity of problems on probabilistic, non- 
deterministic, and alternating decision trees. Journal of the ACM, 32:720-732, 
1985. 

[43] N. Maxemchuck and K. Sabnani. Probabilistic Verification of Communica- 
tion Protocols, volume VII of Protocol Specification, Testing, and Verification. 
North-Holland, 1987. 

[44] X. Nicollin and J. Sifakis. An overview and synthesis on timed process algebras. 
In K.G. Larsen and A. Skou, editors, Proceedings of the Third Workshop on 
Computer Aided Verification, Aalborg, Denmark, July 1991, volume 575 of 
Lecture Notes in Computer Science, pages 376-398. Springer- Verlag, 1992. 

[45] 0. Ore. Graphs and matching theorems. Duke Math. J., 22:625-639, 1955. 

[46] A. Pnueli and L. Zuck. Probabilistic verification by tableaux. In Proceedings 
of the 1st IEEE Symposium on Logic in Computer Science, 1986. 

[47] A. Pnueli and L. Zuck. Verification of multiprocess probabilistic protocols. 
Distributed Computing, l(l):53-72, 1986. 



Bibliography 213 

[48] M. Rabin. The choice coordination problem. Acta Informatica, 17:121-134, 
1982. 

[49] M. Rabin. iV-process mutual exclusion with bounded waiting by 4 log N- shared 
variable. Journal of Computer and System Sciences, 25:66-75, 1982. 

[50] M. Rabin. Randomized byzantine generals. In 24* ft Annual Symposium on 
Foundations of Computer Science, Tucson, Arizona, pages 403-409, 1983. 

[51] J.R. Rao. Reasoning about probabilistic algorithms. In Proceedings of the 
9 th Annual ACM Symposium on Principles of Distributed Computing, Quebec, 
Canada, August 1990. 

[52] J. Reif and P. Spirakis. Real-time synchronization of interprocess communica- 
tion. ACM Transactions on Programming Languages and Systems, 6:215-238, 
1984. 

[53] I. Saias. Proving probabilistic correctness statements: the case of rabin's algo- 
rithm for mutual exclusion. In Proceedings of the ll* ft Annual ACM Symposium 
on Principles of Distributed Computing, Quebec, Canada, pages 263-274, 1992. 

[54] R. Segala and N. Lynch. A model for randomized concurrent systems. 
Manuscript under preparation, 1994. 

[55] K. Seidel. PhD Thesis: Probabilistic Communicating Processes. Oxford Uni- 
versity, 1993. 

[56] A.N. Shiryayev. Probability. Graduate Texts in Mathematics 95. Springer 
Verlag, 1984. 

[57] F.W. Vaandrager and N.A. Lynch. Action transducers and timed automata. In 
W.R. Cleaveland, editor, Proceedings CONCUR 92, Stony Brook, NY, USA, 
volume 630 of Lecture Notes in Computer Science, pages 436-455. Springer- 
Verlag, 1992. 

[58] M. Y. Vardi. Automatic verification of probabilistic concurrent finite-state pro- 
grams. In Proceedings of 26th IEEE Symposium on Foundations of Computer- 
Science, pages 327-338, Portland, OR, 1985. 

[59] Vorob'ev. Game theory. Applications of Mathematics. Springer Verlag, 1977. 

[60] C. West. Protocol Validation by Random State Exploration, volume VI of Pro- 
tocol Specification, Testing, and Verification. North-Holland, 1986. 



214 Bi hliography 

[61] A.C.-C. Yao. Probabibilistic computations: Toward a unified measure of com- 
plexity. In 18* ft Annual Symposium on Foundations of Computer Science, Prov- 
idence, Rhode Island, pages 222-227, 1977. 

[62] L. Zuck and A. Pnueli. Verification of multiprocess probabilistic protocols. 
Distributed Computing, l(l):53-72, 1986. 



Index 



a, a t , 151, 168 
action 

see also structure 

internal, 137, 150, 162, 188, 193 
adequate correctness statement, 53 
adversary, 11, 36, 64, 95, 115, 141 

A, 163 

admissible, 26 

adversary designer, 25, 126, 136 

deterministic adversary, 39 

fair, see fair 

restricted, 79 

specially designed, 29, 128 
Agenerating , 146, 148 
algorithm 

algorithm designer, 25, 126, 136 
arbitrary, see randomized invocation 
atom, 198 
automaton 

probabilistic automaton, 94 

Cj, Cj(t), 151, 165 

c-values, c-sequence, 165 

conditioning 

conditioning by adversary, 54 
probabilistic conditioning, 54 

decision tree, 138 
A k (t), S k (t), 188 
dependence 

sole dependence, 55 
dynamics 

local dynamics, 33, 39 



natural dynamics, 54 

execution, 41, 141 

St, 141 

i-odd execution, 141 

fair, 66 

Fair a, 66 
fault-sequence, 141 

F t , 141, 173 

T u 141 

i-fault-sequence, 141 
feasible, 149 

Feas^, 149, 174, 175 

Q, see sigma field 

game theory, 16, 204 

matrix game, 127, 140, 207 
pure/mixed strategy, 127, 140, 207 
sequential choice of strategies, 205 
Von Neumann, see Von Neumann 
zero sum noncooperative, 205 

global v.s. local point of view, 139 

Graham- Yao 

Byzantine Generals, 36, 130, 132 

information, 147 

implicit v.s. explicit, 53, 129, 137, 
147, 171, 172, 206 

on-line v.s. off-line, 147 
interval 

[/], 197 
invariant, 156 



215 



216 



Index 



J, J(t), 151, 188 

knowledge, 55 

see also information 
Kolmogorov, 43 

Li(t), 165 
law, 198 

C, 174 

C{X), 198 

max-min, 177, 202 
mutual exclusion, 67 

N(k), 67 
no-lockout, 61, 71 
normal form, 168, 180 
Mt, 168 

V{k): participating processes, 67 
V{X), V S (X): power set of X, 197 
V: problem, 125, 126, 133, 135, 136 
F 'generating , 145, 148 
7r prog , see protocol 
Player(l) & Player (2), 16, 25, 126 
precondition, 48 
probability distribution 
vr, 141 

'""prog? 150 

Pa, 144 

P w , 144 

P«,a, 43, 142 

P prog , 162, 189 
Prog , 150 

proof methodology, 127 
Prot(Prog ), 150 
protocol 

IT, 141 

'""prog? 150 

protocol designer, see algorithm de- 
signer 



protocol versus algorithm, 135 

randomized invocation, 150, 162 

arbitrary, 150 

uniform, 150 
rectangle, 42 
round, 66 

schedule, 141 

S t , 141, 151 

S t , 141 

^-schedule, 141 
schema 

event, 43, 52 

probability, 43 
sigma-field 

G*,a, 43 

£, 141 

Qt, 141 

G' t , Ml 

specifications 

see also problem 
Strong Byzantine, 128, 148 
structure 

n/A-structure, 37, 65, 141 

action, 37, 65 

state, 37, 65 

update function, 37, 65 

view, 34, 37, 65, 141 

%X, 204 

t(k), 67 

target property, 48 

time 

discrete, 136 

survival time T, 143 

/ 204 

''max? ^U*± 

i mM (.4), 177, 182, 186, 195 
/ • 204 

i min (7r), 177, 195 
4p., 143 



Index 217 

t(ir), 143 

uniform 

uniform, see randomized invoca- 
tion 

U, 197 
update function, see structure 

view, see structure 

Von Neumann, 127, 133, 140, 164, 205 

WAk), 67 



